Fix Failing Integration Tests

data_sources/sysmon_eventid_15.yml

@@ -1,8 +1,8 @@
 name: Sysmon EventID 15
 id: 95785e02-93b4-47e2-81f1-be326295348e
-version: 4
+version: 5
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-10-13'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata.
 mitre_components:
@@ -22,43 +22,11 @@ supported_TA:
       version: 5.0.1
 fields:
     - _time
+    - action
     - Channel
     - Computer
     - Contents
     - CreationUtcTime
-    - EventChannel
-    - EventCode
-    - EventData_Xml
-    - EventDescription
-    - EventID
-    - EventRecordID
-    - Guid
-    - Hash
-    - IMPHASH
-    - Image
-    - Keywords
-    - Level
-    - MD5
-    - Name
-    - Opcode
-    - ProcessGuid
-    - ProcessID
-    - ProcessId
-    - RecordID
-    - RecordNumber
-    - RuleName
-    - SHA256
-    - SecurityID
-    - SystemTime
-    - System_Props_Xml
-    - TargetFilename
-    - Task
-    - ThreadID
-    - TimeCreated
-    - UserID
-    - UtcTime
-    - Version
-    - action
     - date_hour
     - date_mday
     - date_minute
@@ -70,33 +38,66 @@ fields:
     - dest
     - dvc_nt_host
     - event_id
+    - EventChannel
+    - EventCode
+    - EventData_Xml
+    - EventDescription
+    - EventID
+    - EventRecordID
     - eventtype
     - file_create_time
     - file_hash
     - file_name
     - file_path
+    - Guid
+    - Hash
     - host
     - id
+    - Image
+    - IMPHASH
     - index
+    - Keywords
+    - Level
     - linecount
+    - MD5
+    - Name
+    - Opcode
     - os
     - process_exec
     - process_guid
     - process_id
     - process_name
     - process_path
+    - ProcessGuid
+    - ProcessId
+    - ProcessID
     - punct
+    - RecordID
+    - RecordNumber
+    - RuleName
+    - SecurityID
+    - SHA256
     - signature
     - signature_id
     - source
     - sourcetype
     - splunk_server
+    - System_Props_Xml
+    - SystemTime
     - tag
     - tag::eventtype
+    - TargetFilename
+    - Task
+    - ThreadID
+    - TimeCreated
     - timeendpos
     - timestartpos
+    - user
     - user_id
+    - UserID
+    - UtcTime
     - vendor_product
+    - Version
 output_fields:
     - dest
     - dvc
@@ -110,6 +111,7 @@ output_fields:
     - process_path
     - signature
     - signature_id
+    - user
     - user_id
     - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>15</EventID><Version>2</Version><Level>4</Level><Task>15</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2021-04-28T20:11:34.709744300Z'/><EventRecordID>667860</EventRecordID><Correlation/><Execution ProcessID='1952' ThreadID='2428'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>project-mumbai-host</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2021-04-28 20:11:34.709</Data><Data Name='ProcessGuid'>{ED2ECF8A-C154-6089-F967-00000000BB01}</Data><Data Name='ProcessId'>7000</Data><Data Name='Image'>C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exe</Data><Data Name='TargetFilename'>C:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier</Data><Data Name='CreationUtcTime'>2021-04-28 20:11:33.238</Data><Data Name='Hash'>MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000</Data><Data Name='Contents'>[ZoneTransfer]  ZoneId=3  </Data></EventData></Event>

data_sources/sysmon_eventid_22.yml

@@ -1,8 +1,8 @@
 name: Sysmon EventID 22
 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf
-version: 4
+version: 5
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-10-13'
 author: Patrick Bareiss, Splunk
 description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data.
 mitre_components:
@@ -24,36 +24,6 @@ fields:
     - _time
     - Channel
     - Computer
-    - EventChannel
-    - EventCode
-    - EventData_Xml
-    - EventDescription
-    - EventID
-    - EventRecordID
-    - Guid
-    - Image
-    - Keywords
-    - Level
-    - Name
-    - Opcode
-    - ProcessGuid
-    - ProcessID
-    - ProcessId
-    - QueryName
-    - QueryResults
-    - QueryStatus
-    - RecordID
-    - RecordNumber
-    - RuleName
-    - SecurityID
-    - SystemTime
-    - System_Props_Xml
-    - Task
-    - ThreadID
-    - TimeCreated
-    - UserID
-    - UtcTime
-    - Version
     - date_hour
     - date_mday
     - date_minute
@@ -64,30 +34,61 @@ fields:
     - date_zone
     - dvc_nt_host
     - event_id
+    - EventChannel
+    - EventCode
+    - EventData_Xml
+    - EventDescription
+    - EventID
+    - EventRecordID
     - eventtype
+    - Guid
     - host
     - id
+    - Image
     - index
+    - Keywords
+    - Level
     - linecount
+    - Name
+    - Opcode
     - process_exec
     - process_guid
     - process_name
+    - ProcessGuid
+    - ProcessId
+    - ProcessID
     - punct
     - query
     - query_count
+    - QueryName
+    - QueryResults
+    - QueryStatus
+    - record_type
+    - RecordID
+    - RecordNumber
     - reply_code_id
+    - RuleName
+    - SecurityID
     - signature
     - signature_id
     - source
     - sourcetype
     - splunk_server
     - src
+    - System_Props_Xml
+    - SystemTime
     - tag
     - tag::eventtype
+    - Task
+    - ThreadID
+    - TimeCreated
     - timeendpos
     - timestartpos
     - user_id
+    - UserID
+    - UtcTime
     - vendor_product
+    - Version
 output_fields:
     - answer
     - answer_count

detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml

@@ -1,27 +1,47 @@
 name: ASL AWS ECR Container Upload Unknown User
 id: 886a8f46-d7e2-4439-b9ba-aec238e31732
-version: 12
+version: 13
 creation_date: '2024-05-22'
 modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment.
+description: |-
+    The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
+    It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
 data_source:
     - ASL AWS CloudTrail
 search: |-
-    `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl`
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_ecr_container_upload_unknown_user_filter`
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
-known_false_positives: No false positives have been identified at this time.
+    `amazon_security_lake`
+    api.operation=PutImage
+    NOT `aws_ecr_users_asl`
+
+    | fillnull
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+
+      by actor.user.uid api.operation api.service.name
+         http_request.user_agent
+         src_endpoint.ip actor.user.account.uid
+         cloud.provider cloud.region
+
+    | rename actor.user.account.uid as vendor_account
+             actor.user.uid as user
+             api.operation as action
+             api.service.name as dest
+             cloud.provider as vendor_product
+             cloud.region as vendor_region
+             http_request.user_agent as user_agent
+             src_endpoint.ip as src
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `asl_aws_ecr_container_upload_unknown_user_filter`
+how_to_implement: |-
+    The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: |-
+    No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1204/003/
 drilldown_searches:
@@ -38,7 +58,7 @@ intermediate_findings:
         - field: user
           type: user
           score: 20
-          message: Container uploaded from unknown user $user$
+          message: Container uploaded from unknown user [$user$].
 threat_objects:
     - field: src
       type: ip_address

detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml

@@ -1,13 +1,13 @@
 name: Windows Cloud Files Filter Loaded by Uncommon Process
 id: 77b85062-274e-43a5-9dab-c25862b85291
-version: 1
+version: 2
 creation_date: '2026-05-18'
-modification_date: '2026-05-18'
+modification_date: '2026-10-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
 description: |-
-    The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity.
+    The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity.
     The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.
 data_source:
     - Sysmon EventID 7
@@ -16,22 +16,25 @@ search: |-
     EventID=7
     ImageLoaded="*\\cldapi.dll"
     NOT Image IN (
-      "*\\box.exe",
-      "*\\dropbox.exe",
-      "*\\googledrivefs.exe",
-      "*\\icloud.exe",
-      "*\\onedrive*.exe",
-      "*\\Windows\\explorer.exe"
-      "*\\Windows\\System32\\*",
-      "*\\Windows\\Syswow64\\*",
-      "*\\Windows\\WinSxS\\*"
+        "*\\box.exe",
+        "*\\dropbox.exe",
+        "*\\googledrivefs.exe",
+        "*\\icloud.exe",
+        "*\\onedrive*.exe",
+        "C:\\Windows\\explorer.exe",
+        "C:\\Windows\\System32\\*",
+        "C:\\Windows\\Syswow64\\*",
+        "C:\\Windows\\WinSxS\\*"
     )
+
     | stats count min(_time) as firstTime
                     max(_time) as lastTime
-        by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec
-           process_guid process_hash process_id process_name process_path
-           service_dll_signature_exists service_dll_signature_verified signature_id user_id
-           vendor_product
+
+      by dest loaded_file_path loaded_file
+         process_path process_name process_exec process_guid process_hash process_id
+         service_dll_signature_exists service_dll_signature_verified
+         signature signature_id user_id vendor_product
+
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_cloud_files_filter_loaded_by_uncommon_process_filter`
@@ -57,7 +60,10 @@ intermediate_findings:
         - field: dest
           type: system
           score: 20
-          message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$
+          message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$]
+threat_objects:
+    - field: loaded_file_path
+      type: loaded_file
 analytic_story:
     - RedSun
     - BlueHammer