Fix Issues 6.4 Batch

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -1,23 +1,56 @@
 name: Executable File Written in Administrative SMB Share
 id: f63c34fe-a435-11eb-935a-acde48001122
-version: 13
+version: 14
 creation_date: '2021-04-26'
-modification_date: '2026-05-13'
+modification_date: '2026-08-05'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic detects executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.
+description: |-
+    The following analytic detects executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
+    This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution.
+    If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.
 data_source:
     - Windows Event Log Security 5145
-search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.exe","*.dll") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode ShareName RelativeTargetName ObjectType AccessMask src_user src_port IpAddress dest | `security_content_ctime(firstTime)`  | `executable_file_written_in_administrative_smb_share_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
+search: |-
+    `wineventlog_security`
+    EventCode=5145
+    RelativeTargetName IN (
+        "*.cpl",
+        "*.dll",
+        "*.exe",
+        "*.sys"
+    )
+    ObjectType=File
+    ShareName IN (
+        "\\\\*\\Admin$",
+        "\\\\*\\C$",
+        "\\\\*\\IPC$"
+    )
+
+    | eval AccessMask_ = tonumber(AccessMask, 16)
+    | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0)
+
+    | stats min(_time) as firstTime
+            max(_time) as lastTime count
+
+      by EventCode ShareName RelativeTargetName ObjectType
+         AccessMask src_user src_port IpAddress dest
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `executable_file_written_in_administrative_smb_share_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: |-
+    System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
 references:
     - https://attack.mitre.org/techniques/T1021/002/
     - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/
     - https://labs.vipre.com/trickbot-and-its-modules/
     - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
     - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
+    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes
 drilldown_searches:
     - name: View the detection results for - "$src_user$"
       search: '%original_detection_search% | search  src_user = "$src_user$"'
@@ -28,7 +61,7 @@ drilldown_searches:
       earliest_offset: 7d
       latest_offset: "0"
 finding:
-    title: $src_user$ dropped or created an executable file in known sensitive SMB share.  Share name=$ShareName$, Target name=$RelativeTargetName$, and Access mask=$AccessMask$
+    title: The [$src_user$] dropped or created an executable file in known sensitive SMB share. Share name=[$ShareName$], Target name=[$RelativeTargetName$], and Access mask=[$AccessMask$]
     entity:
         field: src_user
         type: user

detections/endpoint/high_frequency_copy_of_files_in_network_share.yml

@@ -1,19 +1,89 @@
 name: High Frequency Copy Of Files In Network Share
 id: 40925f12-4709-11ec-bb43-acde48001122
-version: 10
+version: 11
 creation_date: '2021-11-17'
-modification_date: '2026-05-13'
+modification_date: '2026-08-05'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
+description: |-
+    The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts.
+    It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares.
+    This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering.
+    If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
 data_source:
     - Windows Event Log Security 5145
-search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" |  bucket _time span=5m | stats values(RelativeTargetName) as valRelativeTargetName, values(ShareName) as valShareName, values(ObjectType) as valObjectType, values(AccessMask) as valAccessmask, values(src_port) as valSrcPort, values(SourceAddress) as valSrcAddress count as numShareName by dest, _time, EventCode, src_user, src_ip | eventstats avg(numShareName) as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, _time, EventCode, src_user |  eval upperThreshold=(avgShareName + stdShareName *3) |  eval isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) |  search isOutlier=1  | `high_frequency_copy_of_files_in_network_share_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: This behavior may seen in normal transfer of file within network if network share is common place for sharing documents.
+search: |-
+    `wineventlog_security`
+    EventCode=5145
+    RelativeTargetName IN (
+        "*.7z", "*.bmp", "*.db", "*.doc", "*.docx",
+        "*.gif", "*.gz", "*.jpg", "*.key", "*.log",
+        "*.pdf", "*.png", "*.ppt", "*.pptx", "*.rar",
+        "*.rtf", "*.tar", "*.txt", "*.xls", "*.xlsx", "*.zip"
+    )
+    ObjectType=File
+    ShareName IN (
+        "\\\\*\\Admin$",
+        "\\\\*\\C$",
+        "\\\\*\\IPC$"
+    )
+    | eval AccessMask_ = tonumber(AccessMask, 16)
+
+    ```
+    We Select only write-related operations:
+        0x2 = WriteData (create/write file)
+        0x4 = AppendData (append to file)
+    ```
+
+    | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0)
+
+    | bucket _time span=5m
+
+    ```
+    Count write events per host, user and source IP within each time window
+    ```
+    | stats
+        values(RelativeTargetName) AS valRelativeTargetName
+        values(ShareName) AS valShareName
+        values(ObjectType) AS valObjectType
+        values(AccessMask) AS valAccessMask
+        values(src_port) AS valSrcPort
+        values(SourceAddress) AS valSrcAddress
+        count AS numFileWriteEvents
+    BY dest _time EventCode src_user src_ip
+
+
+    ```
+    Build a historical baseline for each destination host and user
+    using the average and standard deviation of previous buckets
+    ```
+
+    | eventstats
+        avg(numFileWriteEvents) AS avgFileWriteEvents
+        stdev(numFileWriteEvents) AS stdFileWriteEvents
+        count AS numSlots
+    BY dest EventCode src_user
+
+    | eval upperThreshold=avgFileWriteEvents + (stdFileWriteEvents * 3)
+    | eval isOutlier=if(
+        numFileWriteEvents > 20
+        AND (
+            numSlots < 5
+            OR numFileWriteEvents >= upperThreshold
+        ),
+        1,
+        0
+    )
+    | where isOutlier=1
+    | `high_frequency_copy_of_files_in_network_share_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: |-
+    This behavior may be seen in normal transfer of file within network if network share is common place for sharing documents.
 references:
     - https://attack.mitre.org/techniques/T1537/
+    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes
 drilldown_searches:
     - name: View the detection results for - "$src_user$"
       search: '%original_detection_search% | search  src_user = "$src_user$"'
@@ -28,7 +98,7 @@ intermediate_findings:
         - field: src_user
           type: user
           score: 20
-          message: High frequency copy of document into a network share from $src_ip$ by $src_user$
+          message: High frequency copy of document into a network share [$RelativeTargetName$] from [$src_ip$] by [$src_user$]
 threat_objects:
     - field: src_ip
       type: ip_address

detections/endpoint/network_share_discovery_via_dir_command.yml

@@ -1,19 +1,55 @@
 name: Network Share Discovery Via Dir Command
 id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa
-version: 6
+version: 7
 creation_date: '2023-05-23'
-modification_date: '2026-05-13'
+modification_date: '2026-08-05'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
+description: |-
+    The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity.
+    This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution.
+    If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
 data_source:
     - Windows Event Log Security 5140
-search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1 | stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_share_discovery_via_dir_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: System Administrators may use looks like net.exe or "dir commandline" for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
+search: |-
+    `wineventlog_security`
+    EventCode=5140
+    ShareName IN (
+        "\\\\*\\Admin$",
+        "\\\\*\\C$",
+        "\\\\*\\IPC$"
+    )
+
+
+    ```
+    We Select only select read related operations:
+        0x1 = ReadData (or ListDirectory)
+    ```
+
+    | eval AccessMask_ = tonumber(AccessMask, 16)
+    | where (bit_and(AccessMask_, 1) != 0)
+
+    | stats min(_time) as firstTime
+            max(_time) as lastTime
+            count
+
+    by ShareName IpAddress ObjectType SubjectUserName
+       SubjectDomainName IpPort AccessMask Computer
+
+    | rename Computer as dest
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `network_share_discovery_via_dir_command_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: |-
+    System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks.
+    However, this will typically come only from certain users and certain systems that can be added to an allow list.
 references:
     - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
+    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes
 analytic_story:
     - IcedID
 asset_type: Endpoint