WIP - 02Rel3

[MHaggis]

New Analytic Stories

• Silver Sparrow
• HAFNIUM Group

New Detections

• Cobalt Strike Named Pipes (Passed)
• Suspicious DLLHost no Command Line Arguments (Passed)
• Suspicious GPUpdate no Command Line Arguments (Passed)
• Suspicious SearchProtocolHost no Command Line Arguments (Passed)
• Suspicious PlistBuddy Usage (Experimental)
• Suspicious SQLite3 LSAQuarantine Behavior (Experimental)
• Suspicious Curl Network Connection (Experimental)
• Ryuk Wake on LAN Command (Works, but batch not passing)
• Suspicious Scheduled Task from Public Directory (Passed)
• Fodhelper UAC Bypass (Passed)
• Eventvwr UAC Bypass (Passed)
• Any PowerShell DownloadString (Passed)
• Any PowerShell DownloadFile (Works, but batch not passing)
• Unified Messaging Service Spawning a Process (Experimental)
• Suspicious Unified Messaging Service File Writes (Experimental)
• Nishang PowershellTCPOneLine (Passed)
• W3WP Spawning Shells (Experimental)

Updated Analytic Stories

• Cobalt Strike
• Suspicious MSHTA Activity (formatting issues)

Updated Detections

• NTdsutil Export NTDS
• Suspicious MSBuild Path
• Suspicious MSBuild Rename
• Suspicious Microsoft Workflow Compiler Rename
• Detect Regsvr32 Application Control Bypass
• Windows DisableAntiSpyware Registry (Passed)

[request-info]

We would appreciate it if you could provide us with more info about this issue/pr!

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Cobalt Strike Named Pipes ✅

• diskUsage: 143360
• runDuration: 1.425s
• scanCount: 1112

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Suspicious Scheduled Task from Public Directory ✅

• diskUsage: 286720
• runDuration: 2.148s
• scanCount: 6

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Suspicious Scheduled Task from Public Directory ✅

• diskUsage: 286720
• runDuration: 2.207s
• scanCount: 6

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Ryuk Wake on LAN Command ❌

• diskUsage: 479232
• runDuration: 1.607s
• scanCount: 11

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Any Powershell DownloadFile ❌

• diskUsage: 401408
• runDuration: 11.225s
• scanCount: 16368

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Nishang PowershellTCPOneLine ✅

• diskUsage: 282624
• runDuration: 1.5170000000000001s
• scanCount: 3

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Ryuk Wake on LAN Command ❌

• diskUsage: 483328
• runDuration: 1.7690000000000001s
• scanCount: 7

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Ryuk Wake on LAN Command ❌

• diskUsage: 483328
• runDuration: 1.703s
• scanCount: 1

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Any Powershell DownloadFile ❌

• diskUsage: 401408
• runDuration: 14.116s
• scanCount: 21427