Update detections from Athena FPs

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -1,33 +1,57 @@
 name: Detect Use of cmd exe to Launch Script Interpreters
 id: b89919ed-fe5f-492c-b139-95dbb162039e
-version: 13
-date: '2026-03-10'
+version: 14
+date: '2026-03-24'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 status: production
-type: TTP
-description: The following analytic detects the execution of cscript.exe or wscript.exe processes initiated by cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes within the Endpoint data model. This activity is significant as it may indicate script-based attacks or administrative actions that could be leveraged for malicious purposes. If confirmed malicious, this behavior could allow attackers to execute scripts, potentially leading to code execution, privilege escalation, or persistence within the environment.
+type: Anomaly
+description: |
+    The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives.
+    It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity.
+    The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+
+    FROM datamodel=Endpoint.Processes WHERE
+
+    Processes.parent_process_name="cmd.exe"
+    (
+        Processes.process_name IN ("cscript.exe", "wscript.exe")
         OR
-        Processes.process_name =wscript.exe)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
+        Processes.original_file_name IN ("cscript.exe", "wscript.exe")
+    )
+    NOT Processes.process IN (
+        "* \"C:\\Program Files (x86)\\*",
+        "* \"C:\\Program Files\\*",
+        "* \"C:\\Windows\\System32\\*",
+        "* \"C:\\Windows\\SysWOW64\\*",
+        "* C:\\Program Files (x86)\\*",
+        "* C:\\Program Files\\*",
+        "* C:\\Windows\\System32\\*",
+        "* C:\\Windows\\SysWOW64\\*"
+    )
+    NOT Processes.user="*$"
+    BY Processes.action Processes.dest Processes.original_file_name
+       Processes.parent_process Processes.parent_process_exec
+       Processes.parent_process_guid Processes.parent_process_id
+       Processes.parent_process_name Processes.parent_process_path
+       Processes.process Processes.process_exec Processes.process_guid
+       Processes.process_hash Processes.process_id Processes.process_integrity_level
+       Processes.process_name Processes.process_path Processes.user
+       Processes.user_id Processes.vendor_product
     | `drop_dm_object_name("Processes")`
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: This detection may also be triggered by legitimate applications and numerous service accounts, which often end with a $ sign. To manage this, it's advised to check the service account's activities and, if they are valid, modify the filter macro to exclude them.
+known_false_positives: |-
+    This detection may still generate alerts from legitimate administrative or enterprise activity, particularly in environments that rely on logon scripts, software deployment tools (e.g., SCCM, Intune), legacy applications, or IT automation frameworks that execute scripts via cmd.exe. Some organizations may also have internally developed scripts that run from user-writable directories, which can appear suspicious but are benign. Additionally, environments with non-standard application installations or portable tools may trigger this detection.
 references:
     - https://attack.mitre.org/techniques/T1059/
     - https://redcanary.com/threat-detection-report/techniques/windows-command-shell/
@@ -41,12 +65,14 @@ drilldown_searches:
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 rba:
-    message: cmd.exe launching script interpreters $process_name$ on $dest$
+    message: cmd.exe launched a script interpreter [$process_name$] with CommandLine [$process$] on [$dest$]
     risk_objects:
         - field: dest
           type: system
-          score: 50
-    threat_objects: []
+          score: 20
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - Emotet Malware DHS Report TA18-201A

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -1,21 +1,64 @@
 name: Scheduled Task Deleted Or Created via CMD
 id: d5af132c-7c17-439c-9d31-13d55340f36c
-version: 25
-date: '2026-03-10'
+version: 26
+date: '2026-03-26'
 author: Bhavin Patel, Splunk
 status: production
-type: TTP
-description: The following analytic identifies the creation or deletion of scheduled tasks using the schtasks.exe utility with the -create or -delete flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it can indicate unauthorized system manipulation or malicious intent, often associated with threat actors like Dragonfly and incidents such as the SUNBURST attack. If confirmed malicious, this activity could allow attackers to execute code, escalate privileges, or persist within the environment, posing a significant security risk.
+type: Anomaly
+description: The following analytic detects the creation or deletion of scheduled tasks via schtasks.exe when invoked with create or delete flags, specifically focusing on those executions where the process includes additional parameters such as /tr, /sc, or /ru. The detection uses Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, and filters out events originating from trusted system paths like C:\Windows\System32 or C:\Program Files. It further narrows results to cases where schtasks.exe is launched by potentially suspicious parent processes such as cmd.exe, wscript.exe, or cscript.exe, and excludes service accounts. This behavior may indicate adversary efforts to gain persistence or evade detection by manipulating scheduled tasks using scripts or command shells. If confirmed malicious, such activity could lead to unauthorized code execution or the removal of monitoring mechanisms on endpoints.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*delete* OR Processes.process=*create*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter`'
+search: |
+    | tstats `security_content_summariesonly`
+        count
+        min(_time) as firstTime
+        max(_time) as lastTime
+    FROM datamodel=Endpoint.Processes WHERE
+
+    Processes.parent_process_name="cmd.exe"
+    Processes.process_name="schtasks.exe"
+    Processes.process IN (
+        "*/create*",
+        "*-create*",
+        "*/delete*",
+        "*-delete*"
+    )
+    NOT Processes.process IN (
+        "* \"C:\\Program Files (x86)\\*",
+        "* \"C:\\Program Files\\*",
+        "* \"C:\\Windows\\System32\\*",
+        "* \"C:\\Windows\\SysWOW64\\*",
+        "* C:\\Program Files (x86)\\*",
+        "* C:\\Program Files\\*",
+        "* C:\\Windows\\System32\\*",
+        "* C:\\Windows\\SysWOW64\\*"
+    )
+    NOT Processes.user="*$"
+
+    BY Processes.action Processes.dest Processes.original_file_name
+       Processes.parent_process Processes.parent_process_exec
+       Processes.parent_process_guid Processes.parent_process_id
+       Processes.parent_process_name Processes.parent_process_path
+       Processes.process Processes.process_exec Processes.process_guid
+       Processes.process_hash Processes.process_id Processes.process_integrity_level
+       Processes.process_name Processes.process_path Processes.user
+       Processes.user_id Processes.vendor_product
+
+    | `drop_dm_object_name(Processes)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `scheduled_task_deleted_or_created_via_cmd_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives. Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
+known_false_positives: |-
+    While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives.
+    Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
 references:
     - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
     - https://www.joesandbox.com/analysis/691823/0/html
+    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete
+    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
 drilldown_searches:
     - name: View the detection results for - "$dest$" and "$user$"
       search: '%original_detection_search% | search  dest = "$dest$" user = "$user$"'
@@ -26,15 +69,19 @@ drilldown_searches:
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 rba:
-    message: A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$
+    message: A parent process [parent_process_name$] with commandline [$parent_process$] spawned a schedule task process [$process_name$] with create or delete commandline [$process$] on host [$dest$]
     risk_objects:
         - field: dest
           type: system
-          score: 50
+          score: 20
         - field: user
           type: user
-          score: 50
-    threat_objects: []
+          score: 20
+    threat_objects:
+        - field: parent_process_name
+          type: parent_process_name
+        - field: process
+          type: process
 tags:
     analytic_story:
         - SolarWinds WHD RCE Post Exploitation