Merge branch 'tuoni_and_more' of https://github.com/splunk/security_content into tuoni_and_more

Author: RavenTait

detections/deprecated/cobalt_strike_named_pipes.yml

@@ -1,6 +1,6 @@
 name: Cobalt Strike Named Pipes
 id: 5876d429-0240-4709-8b93-ea8330b411b5
-version: 14
+version: 13
 date: '2025-12-04'
 author: Michael Haag, Splunk
 status: deprecated

detections/endpoint/windows_file_download_via_powershell.yml

@@ -1,6 +1,6 @@
 name: Windows File Download Via PowerShell
 id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de
-version: 6
+version: 5
 date: '2025-12-04'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production

detections/endpoint/windows_suspicious_pua_named_pipe.yml

@@ -12,17 +12,30 @@ description: The following analytic detects the creation or connection to
   this could allow an attacker to abuse these to potentially gain privilege escalation, 
   persistence, c2 communications, or further system compromise.
 data_source:
-- Sysmon EventID 17
-- Sysmon EventID 18
-search: '`sysmon` EventCode=17 OR EventCode=18 AND NOT Image IN (
-    "System","*System32\\svchost.exe","*Program Files*\\Microsoft*","*Program Files*\\Google*",
-    "*AppData\\Local\\Microsoft*","*AppData\\Local\\Google*","*AppData\\Local\\Kingsoft\\*",
-    "*\\Windows\\system32\\SearchIndexer.exe","*\\WINDOWS\\SystemApps\\Microsoft*",
-    "*Program Files\\dotnet\\dotnet.exe","*Program Files*\\Adobe*","*Amazon\\SSM\\Instance*"
+  - Sysmon EventID 17
+  - Sysmon EventID 18
+search: |
+  `sysmon`
+  EventCode IN (17, 18)
+  NOT Image IN (
+      "*:\\Program Files*\\Adobe*",
+      "*:\\Program Files*\\Google*",
+      "*:\\Program Files*\\Microsoft*",
+      "*:\\Program Files\\dotnet\\dotnet.exe",
+      "*:\\Windows\\system32\\SearchIndexer.exe",
+      "*:\\Windows\\System32\\svchost.exe",
+      "*:\\Windows\\SystemApps\\Microsoft*",
+      "*\\Amazon\\SSM\\Instance*",
+      "*\\AppData\\Local\\Google*",
+      "*\\AppData\\Local\\Kingsoft\\*",
+      "*\\AppData\\Local\\Microsoft*",
+      "System",
   )
-  | stats  min(_time) as firstTime max(_time) as lastTime
-  count by dest dvc process_exec process_guid process_id process_path signature signature_id 
-  vendor_product pipe_name user_id Image process_name
+  
+  | stats min(_time) as firstTime max(_time) as lastTime
+    count by dest dvc process_exec process_guid process_id process_path
+             pipe_name user_id process_name signature signature_id vendor_product
+  
   | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description
   | where isnotnull(tool) | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `windows_suspicious_pua_named_pipe_filter`'
@@ -33,56 +46,56 @@ known_false_positives: Some named pipes will attempt to blend
   in. Therefore, some of the named pipes identified and added may cause false positives.
   Filter by process name or pipe name to reduce false positives.
 references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
+  - https://attack.mitre.org/techniques/T1218/009/
+  - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
 drilldown_searches:
-- name: View the detection results for - "$dest$"
-  search: '%original_detection_search% | search  dest = "$dest$"'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
-- name: View risk events for the last 7 days for - "$dest$"
-  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
-    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
-    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
-    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
-    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
+  - name: View the detection results for - "$dest$"
+    search: '%original_detection_search% | search  dest = "$dest$"'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for - "$dest$"
+    search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+      starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+      values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+      as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+      as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+      | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
 rba:
-  message: An instance of $process_name$ was identified on endpoint $dest$ accessing
-    known suspicious named pipes.
+  message: An instance of $process_name$ located in $process_path$ was identified on endpoint $dest$ accessing
+    known suspicious named pipes $pipe_name$.
   risk_objects:
   - field: dest
     type: system
     score: 32
   threat_objects:
-  - field: process_name
-    type: process_name
+    - field: process_name
+      type: process_name
 tags:
   analytic_story:
-  - Trickbot
-  - DarkSide Ransomware
-  - Cobalt Strike
-  - BlackByte Ransomware
-  - Graceful Wipe Out Attack
-  - LockBit Ransomware
-  - Gozi Malware
-  - APT37 Rustonotto and FadeStealer
-  - Hellcat Ransomware
-  - Meterpreter
-  - Brute Ratel C4
-  - Remote Monitoring and Management Software
-  - Tuoni
+    - Trickbot
+    - DarkSide Ransomware
+    - Cobalt Strike
+    - BlackByte Ransomware
+    - Graceful Wipe Out Attack
+    - LockBit Ransomware
+    - Gozi Malware
+    - APT37 Rustonotto and FadeStealer
+    - Hellcat Ransomware
+    - Meterpreter
+    - Brute Ratel C4
+    - Remote Monitoring and Management Software
+    - Tuoni
   asset_type: Endpoint
   mitre_attack_id:
-  - T1559
-  - T1021.002
-  - T1055
+    - T1559
+    - T1021.002
+    - T1055
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
   security_domain: endpoint
 tests:
 - name: True Positive Test

lookups/suspicious_named_pipes.yml

@@ -1,8 +1,8 @@
 name: suspicious_named_pipes
-date: 2025-11-25
+date: 2025-12-04
 version: 1
 id: b6a20ede-6da9-4ea3-896b-905428587ac4
-author: Raven Tait
+author: Raven Tait, Splunk
 lookup_type: csv
 description: A list of named pipes used with known malicious tooling.
 match_type: