From ff4a48009fdab0e5a7485796a8f24c719136f3a6 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Mon, 6 Jan 2025 11:08:54 -0500
Subject: [PATCH 01/19] Add files via upload

---
 ...ows_system_remote_discovery_with_query.yml | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 detections/endpoint/windows_system_remote_discovery_with_query.yml

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
new file mode 100644
index 0000000000..7e021937b8
--- /dev/null
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -0,0 +1,57 @@
+name: Windows System Remote Discovery With Query
+id: 94859172-a521-474f-97ac-4cf4b09634a3
+version: 1
+date: '2025-01-06'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network.
+data_source: 
+- Sysmon Event ID 1
+- Windows Security Event ID 4688
+search: '| tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_system_remote_discovery_with_query_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story: 
+  - Active Directory Discovery
+  asset_type: Endpoint
+  confidence: 75
+  impact: 60
+  message: The user $user$ ran the Query command on a remote system from $dest$
+  mitre_attack_id: 
+  - T1033
+  observable: 
+  - name: dest
+    type: System
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Processes.dest
+  - Processes.user 
+  - Processes.process
+  - Processes.process_name 
+  - Processes.parent_process_name
+  risk_score: 45
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file

From 6370f62c03b0d4bba3ead1f6f3df6c82823add52 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Mon, 6 Jan 2025 13:55:15 -0500
Subject: [PATCH 02/19] Initial upload

---
 ...ve_os_vendors_authenticating_from_user.yml | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
new file mode 100644
index 0000000000..def11169b1
--- /dev/null
+++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -0,0 +1,62 @@
+name: O365 Excessive OS Vendors Authenticating From User
+id: 3451e58a-9457-4985-a600-b616b0cbfda1
+version: 1
+date: '2024-12-19'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection.
+data_source: 
+- Office 365 Universal Audit Log
+search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
+| eval -time = _time
+| bin _time span=15m
+| stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by  ClientIP, UserId, _time
+| where os_count >= 4
+| eval src = ClientIP, user = UserId
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_excessive_os_vendors_authenticating_from_user_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
+known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. 
+references:
+- https://attack.mitre.org/techniques/T1110
+- https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
+- https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/
+- https://github.com/dafthack/MFASweep/tree/master
+tags:
+  analytic_story: 
+  - Office 365 Account Takeover
+  asset_type: O365 Tenant
+  confidence: 75
+  impact: 80
+  message: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$.
+  mitre_attack_id: 
+  - T1110
+  observable: 
+  - name: src
+    type: IP Address
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Operation
+  - ClientIP
+  - UserId
+  - OS
+  risk_score: 60
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log
+    source: o365
+	sourcetype: o365:management:activity
\ No newline at end of file

From ec2cd5dd8092cde814253fe127bc0fb0f33bd218 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Tue, 7 Jan 2025 15:52:52 -0500
Subject: [PATCH 03/19] Update
 detections/endpoint/windows_system_remote_discovery_with_query.yml

Good suggestion

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
---
 .../endpoint/windows_system_remote_discovery_with_query.yml    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index 7e021937b8..1fd676d28e 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2025-01-06'
 author: Steven Dick
 status: production
-type: TTP
+type: Anomaly
+
 description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network.
 data_source: 
 - Sysmon Event ID 1

From 24aae81793668e0474e1764fbd62e8f5c6e79cc1 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Tue, 7 Jan 2025 15:53:10 -0500
Subject: [PATCH 04/19] Update
 detections/endpoint/windows_system_remote_discovery_with_query.yml

EID updates

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
---
 .../endpoint/windows_system_remote_discovery_with_query.yml      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index 1fd676d28e..70fd734d54 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -10,6 +10,7 @@ description: The following analytic detects the execution of `query.exe` with co
 data_source: 
 - Sysmon Event ID 1
 - Windows Security Event ID 4688
+- CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 

From 88ca4c4f071d9d73ad357400b1f24705c2186738 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Tue, 7 Jan 2025 15:54:22 -0500
Subject: [PATCH 05/19] Apply suggestions from code review

Bulk commit on risk score and grammar

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
---
 .../windows_system_remote_discovery_with_query.yml   | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index 70fd734d54..0317666616 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -24,9 +24,12 @@ tags:
   analytic_story: 
   - Active Directory Discovery
   asset_type: Endpoint
-  confidence: 75
-  impact: 60
-  message: The user $user$ ran the Query command on a remote system from $dest$
+  confidence: 49
+
+  impact: 49
+
+  message: The user $user$ ran the Query command to query information from a remote system from $dest$
+
   mitre_attack_id: 
   - T1033
   observable: 
@@ -49,7 +52,8 @@ tags:
   - Processes.process
   - Processes.process_name 
   - Processes.parent_process_name
-  risk_score: 45
+  risk_score: 24
+
   security_domain: endpoint
 tests:
 - name: True Positive Test

From a5b77ca3a515840c76a08a00cd1adda2ed9d297a Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Tue, 7 Jan 2025 15:58:11 -0500
Subject: [PATCH 06/19] Update windows_system_remote_discovery_with_query.yml

Updating with drilldowns
---
 ...ows_system_remote_discovery_with_query.yml | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index 0317666616..e25dc7c28a 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -5,7 +5,6 @@ date: '2025-01-06'
 author: Steven Dick
 status: production
 type: Anomaly
-
 description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network.
 data_source: 
 - Sysmon Event ID 1
@@ -20,16 +19,26 @@ how_to_implement: The detection is based on data that originates from Endpoint D
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate processes on $dest$ 
+  search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name|s$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 tags:
   analytic_story: 
   - Active Directory Discovery
   asset_type: Endpoint
   confidence: 49
-
   impact: 49
-
   message: The user $user$ ran the Query command to query information from a remote system from $dest$
-
   mitre_attack_id: 
   - T1033
   observable: 
@@ -53,11 +62,10 @@ tags:
   - Processes.process_name 
   - Processes.parent_process_name
   risk_score: 24
-
   security_domain: endpoint
 tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: XmlWinEventLog
\ No newline at end of file
+    sourcetype: XmlWinEventLog

From 07ec40165362a6113dcefecda346867bbcd1eb4f Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Tue, 7 Jan 2025 16:02:16 -0500
Subject: [PATCH 07/19] Update
 o365_excessive_os_vendors_authenticating_from_user.yml

Adding drilldowns
---
 ...essive_os_vendors_authenticating_from_user.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
index def11169b1..7a019c456c 100644
--- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -24,6 +24,19 @@ references:
 - https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
 - https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/
 - https://github.com/dafthack/MFASweep/tree/master
+drilldown_searches:
+- name: View the detection results for - "$user$"
+  search: '%original_detection_search% | search user = "$user$"
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: Investigate logons from $user$ 
+  search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) $user|s$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 tags:
   analytic_story: 
   - Office 365 Account Takeover
@@ -59,4 +72,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log
     source: o365
-	sourcetype: o365:management:activity
\ No newline at end of file
+	sourcetype: o365:management:activity

From 104e187eb1cb22b972f30020feff7fea66f8e97c Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Wed, 8 Jan 2025 08:18:26 -0500
Subject: [PATCH 08/19] Update windows_system_remote_discovery_with_query.yml

observables update
---
 .../endpoint/windows_system_remote_discovery_with_query.yml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index e25dc7c28a..9b222b63ca 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -43,7 +43,7 @@ tags:
   - T1033
   observable: 
   - name: dest
-    type: System
+    type: Hostname
     role:
     - Victim
   - name: user

From 56f36dbbc72b76a152a8ceaa2525755a1bca6fd4 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Wed, 8 Jan 2025 08:21:49 -0500
Subject: [PATCH 09/19] Update
 o365_excessive_os_vendors_authenticating_from_user.yml

---
 .../o365_excessive_os_vendors_authenticating_from_user.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
index 7a019c456c..84e665b071 100644
--- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -26,7 +26,7 @@ references:
 - https://github.com/dafthack/MFASweep/tree/master
 drilldown_searches:
 - name: View the detection results for - "$user$"
-  search: '%original_detection_search% | search user = "$user$"
+  search: '%original_detection_search% | search user = "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 - name: View risk events for the last 7 days for - "$user$"

From 51ba4b9394d840c784dd7725c87d4bb388c90375 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Wed, 8 Jan 2025 08:26:05 -0500
Subject: [PATCH 10/19] Update
 o365_excessive_os_vendors_authenticating_from_user.yml

---
 .../o365_excessive_os_vendors_authenticating_from_user.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
index 84e665b071..9304e68215 100644
--- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -72,4 +72,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log
     source: o365
-	sourcetype: o365:management:activity
+    sourcetype: o365:management:activity

From d9e118313457eb7a735bb5b4b8cf06c77d2b1d09 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 14 Jan 2025 11:14:32 -0800
Subject: [PATCH 11/19] minor update

---
 .../o365_excessive_os_vendors_authenticating_from_user.yml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
index 9304e68215..27ded0924f 100644
--- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -7,7 +7,7 @@ status: production
 type: TTP
 description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection.
 data_source: 
-- Office 365 Universal Audit Log
+- O365
 search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
 | eval -time = _time
 | bin _time span=15m
@@ -50,7 +50,7 @@ tags:
   - name: src
     type: IP Address
     role:
-    - Victim
+    - Attacker
   - name: user
     type: User
     role:

From 7186803473073829c1e15cff96a75b2bd08b9bc6 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Wed, 15 Jan 2025 14:00:39 -0500
Subject: [PATCH 12/19] Update
 o365_excessive_os_vendors_authenticating_from_user.yml

---
 .../o365_excessive_os_vendors_authenticating_from_user.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
index 27ded0924f..bb764c8325 100644
--- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
@@ -34,7 +34,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 - name: Investigate logons from $user$ 
-  search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) $user|s$'
+  search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 tags:

From db9a69ddb0695922849094a524caf1ea626c736b Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Wed, 15 Jan 2025 14:14:09 -0500
Subject: [PATCH 13/19] Update and rename
 o365_excessive_os_vendors_authenticating_from_user.yml to
 o365_multiple_os_vendors_authenticating_from_user.yml

rename to align with existing similar detections
---
 ...> o365_multiple_os_vendors_authenticating_from_user.yml} | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 rename detections/cloud/{o365_excessive_os_vendors_authenticating_from_user.yml => o365_multiple_os_vendors_authenticating_from_user.yml} (94%)

diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
similarity index 94%
rename from detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
rename to detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
index bb764c8325..8fe646c285 100644
--- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
@@ -1,4 +1,4 @@
-name: O365 Excessive OS Vendors Authenticating From User
+name: O365 Multiple OS Vendors Authenticating From User
 id: 3451e58a-9457-4985-a600-b616b0cbfda1
 version: 1
 date: '2024-12-19'
@@ -16,7 +16,7 @@ search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
 | eval src = ClientIP, user = UserId
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)`
-| `o365_excessive_os_vendors_authenticating_from_user_filter`'
+| `o365_multiple_os_vendors_authenticating_from_user_filter`'
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
 known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. 
 references:
@@ -54,7 +54,7 @@ tags:
   - name: user
     type: User
     role:
-    - Victim
+    - Attacker
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security

From 0d3b963a4d6391dd853bfe899c28862bd8ce097a Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Wed, 15 Jan 2025 14:17:36 -0500
Subject: [PATCH 14/19] Update
 o365_multiple_os_vendors_authenticating_from_user.yml

---
 .../cloud/o365_multiple_os_vendors_authenticating_from_user.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
index 8fe646c285..ec077a0854 100644
--- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
@@ -54,7 +54,7 @@ tags:
   - name: user
     type: User
     role:
-    - Attacker
+    - Victim
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security

From fab070785ce463ca572bd4153757d046d44830e9 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sun, 2 Feb 2025 12:43:45 -0500
Subject: [PATCH 15/19] Update
 o365_multiple_os_vendors_authenticating_from_user.yml

update to new yaml spec / update search yaml for better readability / remove single quote in SPL issues
---
 ...le_os_vendors_authenticating_from_user.yml | 49 ++++++++-----------
 1 file changed, 20 insertions(+), 29 deletions(-)

diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
index ec077a0854..743aca09e9 100644
--- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
@@ -7,16 +7,17 @@ status: production
 type: TTP
 description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection.
 data_source: 
-- O365
-search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
-| eval -time = _time
-| bin _time span=15m
-| stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by  ClientIP, UserId, _time
-| where os_count >= 4
-| eval src = ClientIP, user = UserId
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`
-| `o365_multiple_os_vendors_authenticating_from_user_filter`'
+- Office 365 Universal Audit Log
+search: |-
+  `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
+  | eval -time = _time
+  | bin _time span=15m
+  | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by  ClientIP, UserId, _time
+  | where os_count >= 4
+  | eval src = ClientIP, user = UserId
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `o365_multiple_os_vendors_authenticating_from_user_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
 known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. 
 references:
@@ -37,35 +38,25 @@ drilldown_searches:
   search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$.
+  risk_objects:
+  - field: user
+    type: user
+    score: 60
+  threat_objects:
+  - field: src
+    type: ip_address
 tags:
   analytic_story: 
   - Office 365 Account Takeover
   asset_type: O365 Tenant
-  confidence: 75
-  impact: 80
-  message: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$.
   mitre_attack_id: 
   - T1110
-  observable: 
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields: 
-  - _time
-  - Operation
-  - ClientIP
-  - UserId
-  - OS
-  risk_score: 60
   security_domain: threat
 tests:
 - name: True Positive Test

From 5b9b5ab07b3945aedfc30e69e81f174752047a3a Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sun, 2 Feb 2025 12:49:10 -0500
Subject: [PATCH 16/19] Update windows_system_remote_discovery_with_query.yml

update to v5 yaml spec
 update search yaml for better readability / remove single quote in SPL issues
---
 ...ows_system_remote_discovery_with_query.yml | 43 ++++++++-----------
 1 file changed, 18 insertions(+), 25 deletions(-)

diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index 9b222b63ca..b432d2b97f 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -10,11 +10,12 @@ data_source:
 - Sysmon Event ID 1
 - Windows Security Event ID 4688
 - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name 
-| `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
-| `windows_system_remote_discovery_with_query_filter`'
+search: |-
+  | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_system_remote_discovery_with_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -32,36 +33,28 @@ drilldown_searches:
   search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name|s$'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: The user $user$ ran the Query command to enumerate the remote system $dest$
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  - field: dest
+    type: system
+    score: 25
+  threat_objects:
+  - field: process_name
+    type: process_name
 tags:
   analytic_story: 
   - Active Directory Discovery
   asset_type: Endpoint
-  confidence: 49
-  impact: 49
-  message: The user $user$ ran the Query command to query information from a remote system from $dest$
   mitre_attack_id: 
   - T1033
-  observable: 
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
   product: 
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields: 
-  - _time
-  - Processes.dest
-  - Processes.user 
-  - Processes.process
-  - Processes.process_name 
-  - Processes.parent_process_name
-  risk_score: 24
   security_domain: endpoint
 tests:
 - name: True Positive Test

From be6b1698a24a2a37ba7a70c831ed3637a857943a Mon Sep 17 00:00:00 2001
From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Date: Wed, 5 Feb 2025 06:57:54 +0000
Subject: [PATCH 17/19] Updated TAs

---
 contentctl.yml                             |  4 ++--
 data_sources/linux_auditd_add_user.yml     |  6 ++++--
 data_sources/linux_auditd_execve.yml       |  5 +++--
 data_sources/linux_auditd_path.yml         |  6 ++++--
 data_sources/linux_auditd_proctitle.yml    |  2 +-
 data_sources/linux_auditd_service_stop.yml |  6 ++++--
 data_sources/linux_auditd_syscall.yml      | 11 ++++++++---
 7 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/contentctl.yml b/contentctl.yml
index 1bd5b72e03..c1a4789702 100644
--- a/contentctl.yml
+++ b/contentctl.yml
@@ -71,9 +71,9 @@ apps:
 - uid: 833
   title: Splunk Add-on for Unix and Linux
   appid: Splunk_TA_nix
-  version: 9.2.0
+  version: 10.0.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_920.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_1000.tgz
 - uid: 5579
   title: Splunk Add-on for CrowdStrike FDR
   appid: Splunk_TA_CrowdStrike_FDR
diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml
index c1d4736a2e..d8604f8794 100644
--- a/data_sources/linux_auditd_add_user.yml
+++ b/data_sources/linux_auditd_add_user.yml
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833
-  version: 9.2.0
+  version: 10.0.0
 fields:
 - msg
 - type
@@ -30,4 +30,6 @@ fields:
 - UID
 - AUID
 - ID
-example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"'
+example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000
+  ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1
+  addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"'
diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml
index 0752725a0f..04f7bb6c35 100644
--- a/data_sources/linux_auditd_execve.yml
+++ b/data_sources/linux_auditd_execve.yml
@@ -10,10 +10,11 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833
-  version: 9.2.0
+  version: 10.0.0
 fields:
 - msg
 - type
 - msg
 - argc
-example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"'
+example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so"
+  a2="./prog"'
diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml
index 03703ad47b..9ff6f3cdef 100644
--- a/data_sources/linux_auditd_path.yml
+++ b/data_sources/linux_auditd_path.yml
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833
-  version: 9.2.0
+  version: 10.0.0
 fields:
 - msg
 - type
@@ -30,4 +30,6 @@ fields:
 - cap_frootid
 - OUID
 - OGID
-example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'
+example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~"
+  inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0
+  cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'
diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml
index 4831ba4585..b20cf3036c 100644
--- a/data_sources/linux_auditd_proctitle.yml
+++ b/data_sources/linux_auditd_proctitle.yml
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833
-  version: 9.2.0
+  version: 10.0.0
 fields:
 - proctitle
 - msg
diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml
index 151da0bdca..f58756c5ae 100644
--- a/data_sources/linux_auditd_service_stop.yml
+++ b/data_sources/linux_auditd_service_stop.yml
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833
-  version: 9.2.0
+  version: 10.0.0
 fields:
 - msg
 - type
@@ -28,4 +28,6 @@ fields:
 - res
 - UID
 - AUID
-example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"'
+example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295
+  ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd"
+  hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"'
diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml
index 73a300e2be..6246b98eaf 100644
--- a/data_sources/linux_auditd_syscall.yml
+++ b/data_sources/linux_auditd_syscall.yml
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833
-  version: 9.2.0
+  version: 10.0.0
 fields:
 - msg
 - type
@@ -20,7 +20,7 @@ fields:
 - success
 - exit
 - a1
-- a2 
+- a2
 - a3
 - items
 - ppid
@@ -51,4 +51,9 @@ fields:
 - EGID
 - SGID
 - FSGID
-example_log: 'type=SYSCALL msg=audit(1723035666.627:3663): arch=c000003e syscall=59 success=yes exit=0 a0=556a6d697a58 a1=556a6d68ad00 a2=556a6d69c980 a3=0 items=2 ppid=1300 pid=1301 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="lsmod" exe="/usr/bin/kmod" subj=unconfined key="rootcmd" ARCH=x86_64 SYSCALL=execve AUID="ubuntu" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"'
+example_log: 'type=SYSCALL msg=audit(1723035666.627:3663): arch=c000003e syscall=59
+  success=yes exit=0 a0=556a6d697a58 a1=556a6d68ad00 a2=556a6d69c980 a3=0 items=2
+  ppid=1300 pid=1301 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
+  tty=pts1 ses=1 comm="lsmod" exe="/usr/bin/kmod" subj=unconfined key="rootcmd" ARCH=x86_64
+  SYSCALL=execve AUID="ubuntu" UID="root" GID="root" EUID="root" SUID="root" FSUID="root"
+  EGID="root" SGID="root" FSGID="root"'

From b599f494fc34a1fd4d73380106e6e201b715a1e0 Mon Sep 17 00:00:00 2001
From: research-bot <bhavin.j.patel91@gmail.com>
Date: Wed, 5 Feb 2025 12:09:04 -0800
Subject: [PATCH 18/19] updating if condition

---
 .github/workflows/appinspect.yml   | 8 +++++++-
 .github/workflows/build.yml        | 9 +++++++--
 .github/workflows/unit-testing.yml | 8 +++++++-
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml
index 6eaf1a1025..063bfb4add 100644
--- a/.github/workflows/appinspect.yml
+++ b/.github/workflows/appinspect.yml
@@ -18,7 +18,13 @@ jobs:
           
       - name: Install Python Dependencies and ContentCTL and Atomic Red Team
         run: |
-          pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+          if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
+            echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
+            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+          else
+            echo "Installing latest contentctl version"
+            pip install contentctl
+          fi
           git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
           git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
       
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9cbfcabf7c..75a1011555 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,8 +19,13 @@ jobs:
           
       - name: Install Python Dependencies and ContentCTL and Atomic Red Team
         run: |
-          echo "CONTENTCTL_VERSION is ${{ vars.CONTENTCTL_VERSION }}"
-          pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+          if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
+            echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
+            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+          else
+            echo "Installing latest contentctl version"
+            pip install contentctl
+          fi
           git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
           git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
       
diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml
index 7efa46679f..3071d016f9 100644
--- a/.github/workflows/unit-testing.yml
+++ b/.github/workflows/unit-testing.yml
@@ -23,7 +23,13 @@ jobs:
         - name: Install Python Dependencies and ContentCTL
           run: |
             python -m pip install --upgrade pip
-            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+            if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
+              echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
+              pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
+            else
+              echo "Installing latest contentctl version"
+              pip install contentctl
+            fi
            
         # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop
         # Make sure we check out the PR, even if it actually lives in a fork

From 7ebb49e63cda7a59eb0ece265b915ae334e5d3b4 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <nasreddineb@splunk.com>
Date: Wed, 5 Feb 2025 22:01:51 +0100
Subject: [PATCH 19/19] update logic to avoid duplicate alerting

---
 detections/endpoint/system_user_discovery_with_query.yml | 9 ++++-----
 .../windows_system_remote_discovery_with_query.yml       | 4 ++--
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index 249c62b457..cd0788aeb9 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -1,7 +1,7 @@
 name: System User Discovery With Query
 id: ad03bfcf-8a91-4bc2-a500-112993deba87
-version: 4
-date: '2024-11-13'
+version: 5
+date: '2025-02-05'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -17,9 +17,8 @@ data_source:
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe")
-  (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe")
+  AND Processes.process="*user*" AND ((NOT Processes.process="*/server*") OR Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `system_user_discovery_with_query_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection
diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index b432d2b97f..58b97c3df7 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -1,7 +1,7 @@
 name: Windows System Remote Discovery With Query
 id: 94859172-a521-474f-97ac-4cf4b09634a3
 version: 1
-date: '2025-01-06'
+date: '2025-02-05'
 author: Steven Dick
 status: production
 type: Anomaly
@@ -11,7 +11,7 @@ data_source:
 - Windows Security Event ID 4688
 - CrowdStrike ProcessRollup2
 search: |-
-  | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process=*/server*) by Processes.dest Processes.user Processes.process_name Processes.parent_process_name 
+  | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process="*/server*") AND NOT Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*") by Processes.dest Processes.user Processes.process_name Processes.parent_process_name 
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`