{
  "docId": "019dd923-5eff-723e-9be5-94b010d7889b",
  "docSlug": "d014079089cef381",
  "documentTitle": "2023 conf SEC1402A",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 11,
  "pageCount": 22,
  "prevPage": 10,
  "nextPage": 12,
  "slideType": "kpi_dashboard",
  "function": "present_framework",
  "density": "dense",
  "nDataPoints": 0,
  "notes": "This is a screenshot of a Splunk Security Essentials interface.",
  "elementsJson": [
    "data_table"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/11",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-11",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd952-832b-73b4-83a8-7767a2d4cf87",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.05,
        "x": 0.67,
        "y": 0.22
      },
      "kind": "list",
      "text": "Data Models: Endpoint",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "13667279-3168-4fac-8d61-4a8a1decb3c5",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.1,
        "x": 0.54,
        "y": 0.22
      },
      "kind": "list",
      "text": "Sourcetypes: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5391d683-ef79-4541-9cb2-946f70e1fab2",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.1,
        "x": 0.42,
        "y": 0.22
      },
      "kind": "list",
      "text": "Recommended Data Sources: Sysmon, Microsoft Windows, Carbon Black Response, CrowdStrike Falcon, Symantec Endpoint Protection",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "8ba75c08-d1e8-45df-b8bf-ea73573755c7",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.65,
        "w": 0.28,
        "x": 0.11,
        "y": 0.22
      },
      "kind": "list",
      "text": "Correlation Searches list including Windows Defender exclusions, process spawning, and registry modifications.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "ee89b4d7-32af-4ebb-9522-6979b8eae563",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.05,
        "x": 0.79,
        "y": 0.22
      },
      "kind": "list",
      "text": "Lookups: No items found.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "f89eb90e-2154-448a-a038-4292490b05a5",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.45,
        "x": 0.32,
        "y": 0.07
      },
      "kind": "paragraph",
      "text": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d5408ebb-149a-42a2-9500-6475e5ea16c1",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.1,
        "x": 0.15,
        "y": 0.07
      },
      "kind": "title",
      "text": "Remcos Malware",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "22103eb7-b39a-4dca-807c-21784bef9042",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [
    {
      "name": "List presentation",
      "slug": "list-presentation",
      "agent": null,
      "layer": "slide",
      "matchId": "cf77a4c6-72aa-4452-8f42-d801c35c56e7",
      "evidence": "list/bullet: Recommended Data Sources: Sysmon, Microsoft Windows, Carbon Black Response, CrowdStrike Falcon, Symantec Endpoint Protection",
      "confidence": 0.7
    }
  ],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 13,
      "from": 9,
      "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Evidence & Proof",
      "beatSlug": "consultants-gambit-evidence-proof",
      "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Evidence",
      "parentBeatSlug": "evidence"
    }
  ],
  "loops": [
    {
      "to": 13,
      "from": 6,
      "name": "Logic Chain",
      "slug": "01-logic-chain",
      "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
      "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
      "evidence": "The document presents a logical chain of ideas and benefits.",
      "position": 0,
      "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
      "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
      "confidence": 0.7,
      "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}