From 059beca313261d5c9bd53258a962ca1d0528dc1e Mon Sep 17 00:00:00 2001 From: peter-cg <682716+peter-cg@users.noreply.github.com> Date: Thu, 27 May 2021 11:17:03 -0500 Subject: [PATCH] fix ssa_validate and add required field to lolbas detection --- bin/ssa_validate.py | 7 ++++--- .../ssa___rare_parent_process_relationship_lolbas.yml | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/bin/ssa_validate.py b/bin/ssa_validate.py index 100c3bfd69..a9f9b166b1 100644 --- a/bin/ssa_validate.py +++ b/bin/ssa_validate.py @@ -7,7 +7,7 @@ from modules.ssa_utils import * from modules.testing_utils import * -DUMB_PIPELINE_INPUT = '| from read_text("/")' \ +DUMB_PIPELINE_INPUT = '| from read_text("test.spl2")' \ '| select from_json_object(value) as input_event' \ '| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))' @@ -71,12 +71,13 @@ def extract_ssa_fields(spl2): fields_file = os.path.join(data_dir.name, "fields.out") write_validation_pipeline(spl2, pipeline_file) subprocess.run(["/usr/bin/java", - "-jar", get_path("%s/humvee.jar" % SSML_CWD), + "-jar", "humvee.jar", 'cli', '-i', pipeline_file, '-o', fields_file, '-f'], - stderr=subprocess.DEVNULL, + #stderr=subprocess.DEVNULL, + cwd=get_path(SSML_CWD), check=True) spl2_ssa_fields = set() with open(fields_file, 'r') as test_out_fh: diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index f9da69febf..7c2ebec3a4 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -76,6 +76,7 @@ tags: product: - Splunk Behavioral Analytics required_fields: + - process - process_name - parent_process_name - _time