Merge pull request #3481 from splunk/revert_prestats_optimization

Revert prestats optimization

Author: patel-bhavin

detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml

@@ -1,7 +1,7 @@
 name: Detect Outlook exe writing a zip file
 id: a51bfe1a-94f0-4822-b1e4-16ae10145893
-version: 11
-date: '2025-02-10'
+version: 12
+date: '2025-04-22'
 author: Bhavin Patel, Splunk
 status: experimental
 type: TTP
@@ -14,38 +14,21 @@ description: The following analytic identifies the execution of `outlook.exe` wr
   the security of the affected system and network.
 data_source:
 - Sysmon EventID 1 AND Sysmon EventID 11
-search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
-  firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe
-  by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-  Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-  Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-  Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-  Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-  | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
-  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+search: '| tstats `security_content_summariesonly`  min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe
+  by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest
+  Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename
+  process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id
+  type=inner[| tstats `security_content_summariesonly` count values(Filesystem.file_path)
+  as file_path values(Filesystem.file_name) as file_name  FROM datamodel=Endpoint.Filesystem
   where (Filesystem.file_path=*.zip*   OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users*
-  OR Filesystem.file_path=*Local\\Temp*) by Filesystem.action Filesystem.dest Filesystem.file_access_time
-  Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name
-  Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid
-  Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)`
-  | table action dest original_file_name parent_process parent_process_exec parent_process_guid
-  parent_process_id parent_process_name parent_process_path process process_exec process_guid
-  process_hash process_id process_integrity_level process_name process_path user user_id
-  vendor_product file_access_time file_create_time file_hash file_modify_time file_name
-  file_path file_acl file_size firstTime lastTime | stats values(action) as action
-  values(parent_process) as parent_process values(dest) as dest values(original_file_name)
-  as original_file_name values(parent_process) as parent_process values(parent_process_exec)
-  as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
-  as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
-  as parent_process_path values(process) as process values(process_exec) as process_exec
-  values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level)
-  as process_integrity_level values(process_name) as process_name values(process_path)
-  as process_path values(user) as user values(user_id) as user_id values(vendor_product)
-  as vendor_product values(file_access_time) as file_access_time values(file_create_time)
-  as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time
-  values(file_name) as file_name values(file_path) as file_path values(file_acl) as
-  file_acl values(file_size) as file_size by process_guid | where isnotnull(process)
-  AND isnotnull(file_name) | `detect_outlook_exe_writing_a_zip_file_filter`'
+  OR Filesystem.file_path=*Local\\Temp*) by  _time span=5m Filesystem.process_id Filesystem.file_hash
+  Filesystem.dest  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields
+  malicious_id outlook_id dest file_path file_name file_hash count file_id] | table
+  firstTime lastTime user malicious_id outlook_id process_name parent_process_name
+  file_name  file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter`'
 how_to_implement: You must be ingesting data that records filesystem and process activity
   from your hosts to populate the Endpoint data model. This is typically populated
   via endpoint detection-and-response product, such as Carbon Black, or endpoint data

detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml

@@ -15,37 +15,16 @@ description: The following analytic detects instances of DLLHost.exe running wit
   network's security.
 data_source:
 - Sysmon EventID 1 AND Sysmon EventID 3
-search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=dllhost.exe Processes.action!="blocked" by Processes.action
-  Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-  Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
-  Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
-  Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
-  Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-  | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
-  count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic
-  where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest
-  All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
-  All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
-  All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
-  All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
-  original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
-  parent_process_name parent_process_path process process_exec process_guid process_hash
-  process_id process_integrity_level process_name process_path user user_id vendor_product
-  app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
-  transport | stats values(action) as action values(dest) as dest values(original_file_name)
-  as original_file_name values(parent_process) as parent_process values(parent_process_exec)
-  as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
-  as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
-  as parent_process_path values(process) as process values(process_exec) as process_exec
-  values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
-  as process_integrity_level values(process_name) as process_name values(process_path)
-  as process_path values(user) as user values(user_id) as user_id values(vendor_product)
-  as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
-  as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
-  as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
-  as src_ip values(src_port) as src_port values(transport) as transport by process_id
-  | where isnotnull(process_name) AND isnotnull(dest_port) | `dllhost_with_no_command_line_arguments_with_network_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe
+  Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)"
+  | rename dest as src | join host process_id [| tstats `security_content_summariesonly`
+  count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port)
+  as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port
+  != 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection
   and Response (EDR) agents. These agents are designed to provide security-related
   telemetry from the endpoints where the agent is installed. To implement this search,

detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml

@@ -1,7 +1,7 @@
 name: GPUpdate with no Command Line Arguments with Network
 id: 2c853856-a140-11eb-a5b5-acde48001122
-version: 9
-date: '2024-12-10'
+version: 10
+date: '2025-04-22'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -16,37 +16,24 @@ description: The following analytic detects the execution of gpupdate.exe withou
   leading to system compromise.
 data_source:
 - Sysmon EventID 1 AND Sysmon EventID 3
-search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=gpupdate.exe by Processes.action Processes.dest Processes.original_file_name
-  Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-  Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-  Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-  Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-  Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-  | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
-  firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where
-  All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest
-  All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
-  All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
-  All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
-  All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
-  original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
-  parent_process_name parent_process_path process process_exec process_guid process_hash
-  process_id process_integrity_level process_name process_path user user_id vendor_product
-  app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
-  transport | stats values(action) as action values(dest) as dest values(original_file_name)
-  as original_file_name values(parent_process) as parent_process values(parent_process_exec)
-  as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
-  as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
-  as parent_process_path values(process) as process values(process_exec) as process_exec
-  values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
-  as process_integrity_level values(process_name) as process_name values(process_path)
-  as process_path values(user) as user values(user_id) as user_id values(vendor_product)
-  as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
-  as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
-  as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
-  as src_ip values(src_port) as src_port values(transport) as transport by process_id
-  | where isnotnull(process_name) AND isnotnull(dest_port) | `gpupdate_with_no_command_line_arguments_with_network_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=gpupdate.exe 
+  by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec 
+  Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name 
+  Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash 
+  Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path 
+  Processes.user Processes.user_id Processes.vendor_product 
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"|
+  join  process_id [| tstats `security_content_summariesonly` count values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip 
+  values(All_Traffic.direction) as direction values(All_Traffic.dvc) as dvc values(All_Traffic.protocol) as protocol 
+  values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src) as src values(All_Traffic.src_ip) as src_ip 
+  values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport FROM datamodel=Network_Traffic.All_Traffic
+  where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
+  | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest
+  parent_process_name process_name process_path process process_id dest_port C2 app dest_ip direction dvc protocol 
+  protocol_version src src_ip src_port transport |
+  `gpupdate_with_no_command_line_arguments_with_network_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection
   and Response (EDR) agents. These agents are designed to provide security-related
   telemetry from the endpoints where the agent is installed. To implement this search,

detections/endpoint/java_writing_jsp_file.yml

@@ -1,7 +1,7 @@
 name: Java Writing JSP File
 id: eb65619c-4f8d-4383-a975-d352765d344b
-version: 7
-date: '2024-11-13'
+version: 8
+date: '2025-04-22'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -14,38 +14,24 @@ description: The following analytic detects the Java process writing a .jsp file
   the affected system, posing a severe security risk.
 data_source:
 - Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11
-search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
-  firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name
-  IN ("java","java.exe", "javaw.exe") by Processes.action Processes.dest Processes.original_file_name
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
   Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-  Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-  | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
-  firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*"
-  by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
+  Processes.user Processes.user_id Processes.vendor_product 
+  | `drop_dm_object_name(Processes)`
+  | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_name="*.jsp*" by _time Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
   Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
   Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-  Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
-  table action dest original_file_name parent_process parent_process_exec parent_process_guid
-  parent_process_id parent_process_name parent_process_path process process_exec process_guid
-  process_hash process_id process_integrity_level process_name process_path user user_id
-  vendor_product file_access_time file_create_time file_hash file_modify_time file_name
-  file_path file_acl file_size firstTime lastTime | stats values(action) as action
-  values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
-  as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
-  as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
-  as parent_process_name values(parent_process_path) as parent_process_path values(process)
-  as process values(process_exec) as process_exec values(process_hash) as process_hash
-  values(process_id) as process_id values(process_integrity_level) as process_integrity_level
-  values(process_name) as process_name values(process_path) as process_path values(user)
-  as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
-  as file_access_time values(file_create_time) as file_create_time values(file_hash)
-  as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
-  values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
-  file_size by process_guid | where isnotnull(process) AND isnotnull(file_name) |
-  `java_writing_jsp_file_filter`'
+  Filesystem.user Filesystem.vendor_product
+  | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
+  file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `java_writing_jsp_file_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`