detection service: update to package folder

automated_detection_testing/detection_service.py

@@ -87,7 +87,7 @@ def main(args):
 
     try:
         module = __import__('generate')
-        results = module.main(REPO_PATH = 'security_content' , OUTPUT_PATH = 'security_content/package', VERBOSE = 'True' )
+        results = module.main(REPO_PATH = 'security_content' , OUTPUT_PATH = 'security_content/dist/escu', PRODUCT = 'ESCU', VERBOSE = 'True' )
     except Exception as e:
         print('Error: ' + str(e))
 

automated_detection_testing/requirements.txt

@@ -5,6 +5,13 @@ aspy.yaml==1.3.0
 atomicwrites==1.4.0
 attackcti==0.3.4.3
 attrs==20.3.0
+azure-common==1.1.25
+azure-core==1.8.2
+azure-identity==1.4.1
+azure-mgmt-compute==17.0.0
+azure-mgmt-core==1.2.1
+azure-mgmt-network==16.0.0
+azure-mgmt-resource==15.0.0
 bcrypt==3.2.0
 boto3==1.17.30
 botocore==1.20.30
@@ -14,7 +21,6 @@ cfgv==2.0.1
 chardet==4.0.0
 configparser==5.0.2
 contextlib2==0.6.0.post1
-cryptography==3.4.4
 Deprecated==1.2.12
 dnspython==2.1.0
 docutils==0.16

detections/endpoint/malicious_powershell_executed_as_a_service.yml

@@ -0,0 +1,48 @@
+name: Malicious Powershell Executed As A Service
+id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
+version: 1
+date: '2021-04-07'
+author: Ryan Becwar
+type: batch
+datamodel:
+- Endpoint
+description: This detection is to identify the abuse the Windows SC.exe to execute
+  malicious commands or payloads via PowerShell.
+search: ' `wineventlog_system` EventCode=7045 Service_File_Name IN ("*powershell.exe*",
+  "*-nop*", "*hid*") | stats count min(_time) as firstTime max(_time) as lastTime
+  by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `malicious_powershell_executed_as_a_service_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows System logs with the Service name, Service File Name Service Start type,
+  and Service Type from your endpoints.
+known_false_positives: Creating a hidden powershell service is rare and could key
+  off of those instances.
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
+- http://az4n6.blogspot.com/2017/
+- https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
+tags:
+  analytic_story:
+  - Malicious Powershell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1569.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - EventCode
+  - Service_File_Name
+  - Service_Type
+  - _time
+  - Service_Name
+  - Service_Start_Type
+  - Service_Account
+  - user
+  security_domain: endpoint
+  automated_detection_testing: passed

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-03-29T18:33:55 UTC
+# On Date: 2021-04-14T07:06:55 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-03-29T18:33:55 UTC
+# On Date: 2021-04-14T07:06:56 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -431,6 +431,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[bits_job_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[bitsadmin_download_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [batch_file_write_to_system32_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -575,6 +583,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[dsquery_domain_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [deleting_shadow_copies_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -903,10 +915,54 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[disable_registry_tool_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_show_hidden_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_windows_behavior_monitoring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_windows_smartscreen_protection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_cmd_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_controlpanel_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_firewall_with_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_folderoptions_windows_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_norun_windows_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [disabling_remote_user_account_control_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[disabling_systemrestore_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_task_manager_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [dump_lsass_via_comsvcs_dll_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1255,6 +1311,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[powershell_start_bitstransfer_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [process_creating_lnk_file_in_suspicious_location_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.