# Detections validated with Atomic Red Team on WS01. See detections/ in the repository.
# Each runs every 5 minutes over [-6m, -1m]; windows do not overlap.

[LAB - T1059.001 - PowerShell encoded command]
description = PowerShell started with an encoded command (any accepted abbreviation of -EncodedCommand) and a Base64 argument. Source: Security 4688 with command-line auditing.
search = index=lab_win source="XmlWinEventLog:Security" EventCode=4688 (NewProcessName="*\\powershell.exe" OR NewProcessName="*\\pwsh.exe") | regex CommandLine="(?i)\s[-/](e|ec|en(c(o(d(e(d(c(o(m(m(a(n(d)?)?)?)?)?)?)?)?)?)?)?)?)\s+[A-Za-z0-9+/=]{16,}" | table _time host SubjectUserName ParentProcessName NewProcessName CommandLine
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -6m@m
dispatch.latest_time = -1m@m
counttype = number of events
relation = greater than
quantity = 0
alert.track = 1
alert.severity = 4

[LAB - T1136.001 - Local account created on member host]
description = Security 4720 on a host other than the domain controller, not created by a machine account or SYSTEM. See detections/T1136.001-local-account-creation.md for the correlated privileged-group variant.
search = index=lab_win source="XmlWinEventLog:Security" EventCode=4720 host!="DC01" | rename TargetUserName as new_account, TargetSid as new_account_sid, SubjectUserName as created_by | search NOT created_by IN ("*$", "SYSTEM") | table _time host new_account new_account_sid created_by SubjectDomainName
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -6m@m
dispatch.latest_time = -1m@m
counttype = number of events
relation = greater than
quantity = 0
alert.track = 1
alert.severity = 3

[LAB - T1053.005 - Scheduled task created]
description = Security 4698 (task created), excluding machine accounts. Keyed on creation; 4701/4702 task updates occur in the WS01 baseline.
search = index=lab_win source="XmlWinEventLog:Security" EventCode=4698 NOT SubjectUserName="*$" | table _time host SubjectUserName TaskName
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -6m@m
dispatch.latest_time = -1m@m
counttype = number of events
relation = greater than
quantity = 0
alert.track = 1
alert.severity = 3

[LAB - T1548.002 - UAC bypass registry key]
description = Sysmon 12/13 write to a shell\open\command key under ms-settings, mscfile, exefile, or Folder, the handler path read by auto-elevating binaries.
search = index=lab_sysmon source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13) TargetObject="*\\shell\\open\\command*" (TargetObject="*ms-settings*" OR TargetObject="*mscfile*" OR TargetObject="*exefile*" OR TargetObject="*\\Folder\\*") | table _time host User Image EventType TargetObject Details
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -6m@m
dispatch.latest_time = -1m@m
counttype = number of events
relation = greater than
quantity = 0
alert.track = 1
alert.severity = 4

[LAB - T1070.001 - Event log cleared]
description = Security log cleared (1102) or any log cleared (System 104). Events forwarded before the clear remain in Splunk.
search = index=lab_win ((source="XmlWinEventLog:Security" EventCode=1102) OR (source="XmlWinEventLog:System" EventCode=104)) | table _time host source EventCode SubjectUserName Channel
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -6m@m
dispatch.latest_time = -1m@m
counttype = number of events
relation = greater than
quantity = 0
alert.track = 1
alert.severity = 5