From c5df761c4281046fce2f405b96bdd1d664282a84 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 30 May 2022 06:49:55 -0600
Subject: [PATCH 1/8] Falling for Follina

---
 .../windows_office_product_spawning_msdt.yml  | 86 +++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100644 detections/endpoint/windows_office_product_spawning_msdt.yml

diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml
new file mode 100644
index 0000000000..8c3c52d613
--- /dev/null
+++ b/detections/endpoint/windows_office_product_spawning_msdt.yml
@@ -0,0 +1,86 @@
+name: Windows Office Product Spawning MSDT
+id: 127eba64-c981-40bf-8589-1830638864a7
+version: 1
+date: '2022-05-30'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document.
+  During triage, review file modifications for html. In addition, parallel processes including PowerShell, CertUtil
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `windows_office_product_spawning_msdt_filter`'
+how_to_implement: how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, however filter as needed.
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - UPDATE_DATASET_URL
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Office parent process $parent_process_name$ has spawned a child
+    process $process_name$ on host $dest$.
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 100
+  security_domain: endpoint
\ No newline at end of file

From 0df4a18e94cd872f8b2e808d2a95e80fb26a8e6b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 30 May 2022 06:59:14 -0600
Subject: [PATCH 2/8] Update windows_office_product_spawning_msdt.yml

---
 detections/endpoint/windows_office_product_spawning_msdt.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml
index 8c3c52d613..5ff2792f31 100644
--- a/detections/endpoint/windows_office_product_spawning_msdt.yml
+++ b/detections/endpoint/windows_office_product_spawning_msdt.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document.
-  During triage, review file modifications for html. In addition, parallel processes including PowerShell, CertUtil
+  During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe

From bc46202f260129955b6befb8fa686488216acc1c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 30 May 2022 07:09:33 -0600
Subject: [PATCH 3/8] Create windows_execute_commands_with_msdt.yml

---
 .../windows_execute_commands_with_msdt.yml    | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 detections/endpoint/windows_execute_commands_with_msdt.yml

diff --git a/detections/endpoint/windows_execute_commands_with_msdt.yml b/detections/endpoint/windows_execute_commands_with_msdt.yml
new file mode 100644
index 0000000000..cdcd7274d2
--- /dev/null
+++ b/detections/endpoint/windows_execute_commands_with_msdt.yml
@@ -0,0 +1,85 @@
+name: Windows Execute Commands with MSDT
+id: e1d5145f-38fe-42b9-a5d5-457796715f97
+version: 1
+date: '2022-05-30'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. 
+  During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe
+  Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_execute_commands_with_msdt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present based on 
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - UPDATE_DATASET_URL
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: A parent process $parent_process_name$ has spawned a child
+    process $process_name$ on host $dest$ possibly indicative of indirect command execution.
+  mitre_attack_id:
+  - T1202
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 100
+  security_domain: endpoint
\ No newline at end of file

From 87a9aea4dd2e978ffb8652bc80fa14bfc84e3fe5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 31 May 2022 07:16:05 -0600
Subject: [PATCH 4/8] Complete Follina

---
 ..._execute_arbitrary_commands_with_msdt.yml} | 10 +++++---
 .../windows_office_product_spawning_msdt.yml  |  5 +++-
 ...stic_tool_vulnerability_cve_2022_30190.yml | 25 +++++++++++++++++++
 stories/windows_drivers.yml                   |  1 -
 ...cute_arbitrary_commands_with_msdt.test.yml | 13 ++++++++++
 ...dows_office_product_spawning_msdt.test.yml | 13 ++++++++++
 6 files changed, 61 insertions(+), 6 deletions(-)
 rename detections/endpoint/{windows_execute_commands_with_msdt.yml => windows_execute_arbitrary_commands_with_msdt.yml} (91%)
 create mode 100644 stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
 create mode 100644 tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml
 create mode 100644 tests/endpoint/windows_office_product_spawning_msdt.test.yml

diff --git a/detections/endpoint/windows_execute_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
similarity index 91%
rename from detections/endpoint/windows_execute_commands_with_msdt.yml
rename to detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
index cdcd7274d2..8b1887f1b1 100644
--- a/detections/endpoint/windows_execute_commands_with_msdt.yml
+++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
@@ -1,8 +1,8 @@
-name: Windows Execute Commands with MSDT
+name: Windows Execute Arbitrary Commands with MSDT
 id: e1d5145f-38fe-42b9-a5d5-457796715f97
 version: 1
 date: '2022-05-30'
-author: Michael Haag, Splunk
+author: Michael Haag, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_execute_commands_with_msdt_filter`'
+  | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present based on 
 references:
@@ -26,8 +26,10 @@ references:
   - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
   asset_type: Endpoint
+  cve:
+  - CVE-2022-30190
   cis20:
   - CIS 3
   - CIS 5
diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml
index 5ff2792f31..8333e8887a 100644
--- a/detections/endpoint/windows_office_product_spawning_msdt.yml
+++ b/detections/endpoint/windows_office_product_spawning_msdt.yml
@@ -2,7 +2,7 @@ name: Windows Office Product Spawning MSDT
 id: 127eba64-c981-40bf-8589-1830638864a7
 version: 1
 date: '2022-05-30'
-author: Michael Haag, Splunk
+author: Michael Haag, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -27,7 +27,10 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
   asset_type: Endpoint
+  cve:
+  - CVE-2022-30190
   cis20:
   - CIS 3
   - CIS 5
diff --git a/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
new file mode 100644
index 0000000000..705256576d
--- /dev/null
+++ b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
@@ -0,0 +1,25 @@
+name: Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+id: 2a60a99e-c93a-4036-af70-768fac838019
+version: 1
+date: '2022-05-31'
+author: 'Michael Haag, Teoderick Contreras, Splunk'
+description: On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability.
+narrative: 
+  A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights.
+references:
+  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story: Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml
index 65ea415805..598d0a684c 100644
--- a/stories/windows_drivers.yml
+++ b/stories/windows_drivers.yml
@@ -16,7 +16,6 @@ references:
   - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
 tags:
   analytic_story: Windows Drivers
-  category: []
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml b/tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml
new file mode 100644
index 0000000000..b3f15312c6
--- /dev/null
+++ b/tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml
@@ -0,0 +1,13 @@
+name: Windows Execute Arbitrary Commands with MSDT Unit Test
+tests:
+- name: Windows Execute Arbitrary Commands with MSDT
+  file: endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: msdt.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_office_product_spawning_msdt.test.yml b/tests/endpoint/windows_office_product_spawning_msdt.test.yml
new file mode 100644
index 0000000000..867bdaf783
--- /dev/null
+++ b/tests/endpoint/windows_office_product_spawning_msdt.test.yml
@@ -0,0 +1,13 @@
+name: Windows Office Product Spawning MSDT Unit Test
+tests:
+- name: Windows Office Product Spawning MSDT
+  file: endpoint/windows_office_product_spawning_msdt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: msdt.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 3a1ad123bd8d1bc79a9da8977f1343f1ba3f740c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 31 May 2022 07:23:11 -0600
Subject: [PATCH 5/8] url

---
 .../endpoint/windows_execute_arbitrary_commands_with_msdt.yml | 4 ++--
 detections/endpoint/windows_office_product_spawning_msdt.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
index 8b1887f1b1..439f0d1a04 100644
--- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
@@ -39,7 +39,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
   impact: 100
   kill_chain_phases:
   - Exploitation
@@ -58,7 +58,7 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_process_name
+  - name: Process
     type: Parent Process
     role:
     - Parent Process
diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml
index 8333e8887a..9098c9e3f1 100644
--- a/detections/endpoint/windows_office_product_spawning_msdt.yml
+++ b/detections/endpoint/windows_office_product_spawning_msdt.yml
@@ -40,7 +40,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
   impact: 100
   kill_chain_phases:
   - Exploitation
@@ -60,7 +60,7 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_process_name
+  - name: Process
     type: Parent Process
     role:
     - Parent Process

From 2af655958335400e04ea19dbc3de69013c3bbcb9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 31 May 2022 07:32:49 -0600
Subject: [PATCH 6/8] computer hard

---
 .../windows_execute_arbitrary_commands_with_msdt.yml        | 6 +++---
 .../endpoint/windows_office_product_spawning_msdt.yml       | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
index 439f0d1a04..8edf5cb667 100644
--- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
@@ -54,12 +54,12 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
-  - name: Process
-    type: Parent Process
+  - name: parent_process_name
+    type: Process
     role:
     - Parent Process
   - name: process_name
diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml
index 9098c9e3f1..fe9ec16b7a 100644
--- a/detections/endpoint/windows_office_product_spawning_msdt.yml
+++ b/detections/endpoint/windows_office_product_spawning_msdt.yml
@@ -56,12 +56,12 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
-  - name: Process
-    type: Parent Process
+  - name: parent_process_name
+    type: Process
     role:
     - Parent Process
   - name: process_name

From 5d3b3028889abd922784c3d5e74042777f933cc4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 31 May 2022 07:43:57 -0600
Subject: [PATCH 7/8] Update windows_drivers.yml

---
 stories/windows_drivers.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml
index 598d0a684c..ac2e14ea17 100644
--- a/stories/windows_drivers.yml
+++ b/stories/windows_drivers.yml
@@ -16,6 +16,8 @@ references:
   - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
 tags:
   analytic_story: Windows Drivers
+  category: 
+  - Adversary Tactics
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From 376d1f2943ef5f13a1ac9305c2f43926acc1d4af Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 31 May 2022 11:12:24 -0600
Subject: [PATCH 8/8] filter note

---
 .../endpoint/windows_execute_arbitrary_commands_with_msdt.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
index 8edf5cb667..7b1e061c6b 100644
--- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present based on 
+known_false_positives: False positives may be present, filter as needed. 
 references:
   - https://isc.sans.edu/diary/rss/28694
   - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
@@ -84,4 +84,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 100
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint