From 0fe8a854ec16de49077fa7c0fab6ca76516ebf0e Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 28 Mar 2022 14:03:10 +0200 Subject: [PATCH] fixed api and mitre attack enrichment --- .../builder/attack_enrichment.py | 12 +- .../security_content_detection_builder.py | 1 + .../adapter/data/lookups/mitre_enrichment.csv | 16 + .../obj_to_json_adapter_data/baselines.json | 90 +- .../baselines_ref.json | 90 +- .../obj_to_json_adapter_data/deployments.json | 36 +- .../deployments_ref.json | 36 +- .../obj_to_json_adapter_data/detections.json | 328 +++--- .../detections_ref.json | 318 +++--- .../obj_to_json_adapter_data/lookups.json | 20 +- .../obj_to_json_adapter_data/lookups_ref.json | 20 +- .../obj_to_json_adapter_data/macros.json | 16 +- .../obj_to_json_adapter_data/macros_ref.json | 16 +- .../response_task.json | 67 -- .../response_task_ref.json | 67 -- .../response_tasks.json | 132 +-- .../response_tasks_ref.json | 69 ++ .../obj_to_json_adapter_data/stories.json | 978 +++++++++--------- .../obj_to_json_adapter_data/stories_ref.json | 504 +++++++++ .../obj_to_json_adapter_data/story.json | 430 -------- .../obj_to_json_adapter_data/story_ref.json | 430 -------- .../obj_to_md_data/_data/navigation.yml | 6 +- .../obj_to_md_data_ref/_data/navigation.yml | 6 +- .../tests/adapter/test_obj_to_json_adapter.py | 8 +- ...test_security_content_detection_builder.py | 14 +- .../test_security_content_story_builder.py | 11 - lookups/mitre_enrichment.csv | 16 + 27 files changed, 1685 insertions(+), 2052 deletions(-) delete mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task.json delete mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task_ref.json create mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json create mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories_ref.json delete mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story.json delete mode 100644 bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story_ref.json diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/attack_enrichment.py b/bin/contentctl_project/contentctl_infrastructure/builder/attack_enrichment.py index 11cacb5bc7..2988f2aad0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/attack_enrichment.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/attack_enrichment.py @@ -1,4 +1,8 @@ +import csv +import os +from posixpath import split + from attackcti import attack_client import logging @@ -35,6 +39,12 @@ class AttackEnrichment(): except Exception as err: print('Warning: ' + str(err)) - + print('Use local copy lookups/mitre_enrichment.csv') + dict_from_csv = {} + file_path = os.path.join(os.path.dirname(__file__), '../../../../lookups/mitre_enrichment.csv') + with open(file_path, mode='r') as inp: + reader = csv.reader(inp) + attack_lookup = {rows[0]:{'technique': rows[1], 'tactics': rows[2].split('|'), 'groups': rows[3].split('|')} for rows in reader} + attack_lookup.pop('mitre_id') return attack_lookup \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 08cd5c3760..95465afeff 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -178,6 +178,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): ) self.security_content_obj.tags.mitre_attack_enrichments.append(mitre_attack_enrichment) else: + #print("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name) raise ValueError("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv index 0717cbc6ba..d2c021c4e4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv @@ -438,3 +438,19 @@ T1006,Direct Volume Access,Defense Evasion,no T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom T1001,Data Obfuscation,Command And Control,Axiom +T1204.003,Malicious Image,Execution,no +T1580,Cloud Infrastructure Discovery,Discovery,no +T1547.014,Active Setup,Persistence|Privilege Escalation,no +T1595,Active Scanning,Reconnaissance,no +T1558.004,AS-REP Roasting,Credential Access,no +T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no +T1016.001,Internet Connection Discovery,Discovery,no +T1547.012,Print Processors,Persistence|Privilege Escalation,no +T1592,Gather Victim Host Information,Reconnaissance,no +T1218.012,Verclsid,Defense Evasion,no +T1590,Gather Victim Network Information,Reconnaissance,no +T1590.005,IP Addresses,Reconnaissance,no +T1588.002,Tool,Resource Development,no +T1557.002,ARP Cache Poisoning,Credential Access|Collection,no +T1542.005,TFTP Boot,Defense Evasion|Persistence,no +T1020.001,Traffic Duplication,Exfiltration,no \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json index 24500a9003..8b965014c4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json @@ -1,46 +1,48 @@ -[ - { - "name": "Previously Seen Users In CloudTrail - Update", - "id": "66ff71c2-7e01-47dd-a041-906688c9d322", - "version": 1, - "date": "2020-05-28", - "author": "Rico Valdez, Splunk", - "type": "Baseline", - "datamodel": [ - "Authentication" - ], - "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", - "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", - "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", - "known_false_positives": "none", - "references": [], - "tags": { - "analytic_story": [ - "Suspicious Cloud Authentication Activities" +{ + "baselines": [ + { + "name": "Previously Seen Users In CloudTrail - Update", + "id": "66ff71c2-7e01-47dd-a041-906688c9d322", + "version": 1, + "date": "2020-05-28", + "author": "Rico Valdez, Splunk", + "type": "Baseline", + "datamodel": [ + "Authentication" ], - "deployments": [ - "Daily Cache Updates" - ], - "detections": [ - "Detect AWS Console Login by User from New Country", - "Detect AWS Console Login by User from New Region", - "Detect AWS Console Login by User from New City", - "Detect AWS Console Login by New User", - "Attempted Credential Dump From Registry via Reg exe" - ], - "product": [ - "Splunk Security Analytics for AWS", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Authentication.signature", - "Authentication.user", - "Authentication.src" - ], - "security_domain": "network" + "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", + "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", + "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", + "known_false_positives": "none", + "references": [], + "tags": { + "analytic_story": [ + "Suspicious Cloud Authentication Activities" + ], + "deployments": [ + "Daily Cache Updates" + ], + "detections": [ + "Detect AWS Console Login by User from New Country", + "Detect AWS Console Login by User from New Region", + "Detect AWS Console Login by User from New City", + "Detect AWS Console Login by New User", + "Attempted Credential Dump From Registry via Reg exe" + ], + "product": [ + "Splunk Security Analytics for AWS", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "required_fields": [ + "_time", + "Authentication.signature", + "Authentication.user", + "Authentication.src" + ], + "security_domain": "network" + } } - } -] \ No newline at end of file + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json index 24500a9003..8b965014c4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json @@ -1,46 +1,48 @@ -[ - { - "name": "Previously Seen Users In CloudTrail - Update", - "id": "66ff71c2-7e01-47dd-a041-906688c9d322", - "version": 1, - "date": "2020-05-28", - "author": "Rico Valdez, Splunk", - "type": "Baseline", - "datamodel": [ - "Authentication" - ], - "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", - "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", - "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", - "known_false_positives": "none", - "references": [], - "tags": { - "analytic_story": [ - "Suspicious Cloud Authentication Activities" +{ + "baselines": [ + { + "name": "Previously Seen Users In CloudTrail - Update", + "id": "66ff71c2-7e01-47dd-a041-906688c9d322", + "version": 1, + "date": "2020-05-28", + "author": "Rico Valdez, Splunk", + "type": "Baseline", + "datamodel": [ + "Authentication" ], - "deployments": [ - "Daily Cache Updates" - ], - "detections": [ - "Detect AWS Console Login by User from New Country", - "Detect AWS Console Login by User from New Region", - "Detect AWS Console Login by User from New City", - "Detect AWS Console Login by New User", - "Attempted Credential Dump From Registry via Reg exe" - ], - "product": [ - "Splunk Security Analytics for AWS", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Authentication.signature", - "Authentication.user", - "Authentication.src" - ], - "security_domain": "network" + "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", + "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", + "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", + "known_false_positives": "none", + "references": [], + "tags": { + "analytic_story": [ + "Suspicious Cloud Authentication Activities" + ], + "deployments": [ + "Daily Cache Updates" + ], + "detections": [ + "Detect AWS Console Login by User from New Country", + "Detect AWS Console Login by User from New Region", + "Detect AWS Console Login by User from New City", + "Detect AWS Console Login by New User", + "Attempted Credential Dump From Registry via Reg exe" + ], + "product": [ + "Splunk Security Analytics for AWS", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "required_fields": [ + "_time", + "Authentication.signature", + "Authentication.user", + "Authentication.src" + ], + "security_domain": "network" + } } - } -] \ No newline at end of file + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments.json index ba97ef9f78..10436f6129 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments.json @@ -1,18 +1,20 @@ -[ - { - "name": "ESCU Default Configuration Baseline", - "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", - "date": "2021-12-21", - "author": "Patrick Bareiss", - "description": "This configuration file applies to all detections of type baseline.", - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m", - "schedule_window": "auto" - }, - "tags": { - "type": "Baseline" +{ + "deployments": [ + { + "name": "ESCU Default Configuration Baseline", + "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", + "date": "2021-12-21", + "author": "Patrick Bareiss", + "description": "This configuration file applies to all detections of type baseline.", + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m", + "schedule_window": "auto" + }, + "tags": { + "type": "Baseline" + } } - } -] \ No newline at end of file + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments_ref.json index ba97ef9f78..10436f6129 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments_ref.json @@ -1,18 +1,20 @@ -[ - { - "name": "ESCU Default Configuration Baseline", - "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", - "date": "2021-12-21", - "author": "Patrick Bareiss", - "description": "This configuration file applies to all detections of type baseline.", - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m", - "schedule_window": "auto" - }, - "tags": { - "type": "Baseline" +{ + "deployments": [ + { + "name": "ESCU Default Configuration Baseline", + "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", + "date": "2021-12-21", + "author": "Patrick Bareiss", + "description": "This configuration file applies to all detections of type baseline.", + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m", + "schedule_window": "auto" + }, + "tags": { + "type": "Baseline" + } } - } -] \ No newline at end of file + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json index f51179306f..bc621949e6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json @@ -1,168 +1,168 @@ -[ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", - "version": 6, - "date": "2021-09-16", - "author": "Patrick Bareiss, Splunk", - "type": "TTP", - "datamodel": [ - "Endpoint" - ], - "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", - "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", - "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", - "known_false_positives": "None identified.", - "references": [ - "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" - ], - "tags": { +{ + "detections": [ + { "name": "Attempted Credential Dump From Registry via Reg exe", - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" + "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", + "version": 6, + "date": "2021-09-16", + "author": "Patrick Bareiss, Splunk", + "type": "TTP", + "datamodel": [ + "Endpoint" ], - "asset_type": "Endpoint", - "automated_detection_testing": "passed", - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" + "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", + "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", + "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", + "known_false_positives": "None identified.", + "references": [ + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" ], - "confidence": 100, - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "dataset": [ - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" - ], - "impact": 90, - "kill_chain_phases": [ - "Actions on Objectives" - ], - "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", - "mitre_attack_id": [ - "T1003.002", - "T1003" - ], - "nist": [ - "DE.CM" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Processes.dest", - "Processes.user", - "Processes.parent_process_name", - "Processes.parent_process", - "Processes.original_file_name", - "Processes.process_name", - "Processes.process", - "Processes.process_id", - "Processes.parent_process_path", - "Processes.process_path", - "Processes.parent_process_id" - ], - "risk_score": 90, - "security_domain": "endpoint", - "risk_severity": "high", - "supported_tas": [ - "Splunk_TA_microsoft_sysmon" - ], - "mitre_attack_enrichments": [ - { - "mitre_attack_id": "T1003.002", - "mitre_attack_technique": "Security Account Manager", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "Dragonfly 2.0", - "GALLIUM", - "Ke3chang", - "Night Dragon", - "Threat Group-3390", - "Wizard Spider", - "menuPass" - ] - }, - { - "mitre_attack_id": "T1003", - "mitre_attack_technique": "OS Credential Dumping", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "APT28", - "APT32", - "APT39", - "Axiom", - "Frankenstein", - "Leviathan", - "Poseidon Group", - "Sowbug", - "Suckfly", - "Tonto Team" - ] - } - ] - }, - "macros": [ - { - "name": "process_reg", - "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", - "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" + "tags": { + "name": "Attempted Credential Dump From Registry via Reg exe", + "analytic_story": [ + "Credential Dumping", + "DarkSide Ransomware" + ], + "asset_type": "Endpoint", + "automated_detection_testing": "passed", + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "confidence": 100, + "context": [ + "Source:Endpoint", + "Stage:Credential Access" + ], + "dataset": [ + "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" + ], + "impact": 90, + "kill_chain_phases": [ + "Actions on Objectives" + ], + "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", + "mitre_attack_id": [ + "T1003.002", + "T1003" + ], + "nist": [ + "DE.CM" + ], + "observable": [ + { + "name": "user", + "type": "User", + "role": [ + "Victim" + ] + }, + { + "name": "dest", + "type": "Hostname", + "role": [ + "Victim" + ] + }, + { + "name": "parent_process_name", + "type": "Process", + "role": [ + "Parent Process" + ] + }, + { + "name": "process_name", + "type": "Process", + "role": [ + "Child Process" + ] + } + ], + "product": [ + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "required_fields": [ + "_time", + "Processes.dest", + "Processes.user", + "Processes.parent_process_name", + "Processes.parent_process", + "Processes.original_file_name", + "Processes.process_name", + "Processes.process", + "Processes.process_id", + "Processes.parent_process_path", + "Processes.process_path", + "Processes.parent_process_id" + ], + "risk_score": 90, + "security_domain": "endpoint", + "risk_severity": "high", + "supported_tas": [ + "Splunk_TA_microsoft_sysmon" + ], + "mitre_attack_enrichments": [ + { + "mitre_attack_id": "T1003.002", + "mitre_attack_technique": "Security Account Manager", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "Dragonfly 2.0", + "Ke3chang", + "Night Dragon", + "Soft Cell", + "Threat Group-3390", + "menuPass" + ] + }, + { + "mitre_attack_id": "T1003", + "mitre_attack_technique": "OS Credential Dumping", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "APT28", + "APT32", + "APT39", + "Axiom", + "Frankenstein", + "Leviathan", + "Poseidon Group", + "Sowbug", + "Suckfly" + ] + } + ] }, - { - "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", - "definition": "search *", - "description": "Update this macro to limit the output results to filter out false positives." - } - ], - "lookups": [], - "cve_enrichment": [], - "splunk_app_enrichment": [ - { - "name": "Splunk Add-on for Sysmon", - "url": "https://splunkbase.splunk.com/app/5709" - } - ], - "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", - "source": "detection" - } -] \ No newline at end of file + "macros": [ + { + "name": "process_reg", + "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", + "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" + }, + { + "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", + "definition": "search *", + "description": "Update this macro to limit the output results to filter out false positives." + } + ], + "lookups": [], + "cve_enrichment": [], + "splunk_app_enrichment": [ + { + "name": "Splunk Add-on for Sysmon", + "url": "https://splunkbase.splunk.com/app/5709" + } + ], + "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", + "source": "detection" + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections_ref.json index b891216fff..bc621949e6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections_ref.json @@ -1,158 +1,168 @@ -[ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", - "version": 6, - "date": "2021-09-16", - "author": "Patrick Bareiss, Splunk", - "type": "TTP", - "datamodel": [ - "Endpoint" - ], - "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", - "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", - "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", - "known_false_positives": "None identified.", - "references": [ - "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" - ], - "tags": { +{ + "detections": [ + { "name": "Attempted Credential Dump From Registry via Reg exe", - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" + "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", + "version": 6, + "date": "2021-09-16", + "author": "Patrick Bareiss, Splunk", + "type": "TTP", + "datamodel": [ + "Endpoint" ], - "asset_type": "Endpoint", - "automated_detection_testing": "passed", - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" + "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", + "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", + "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", + "known_false_positives": "None identified.", + "references": [ + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" ], - "confidence": 100, - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "dataset": [ - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" - ], - "impact": 90, - "kill_chain_phases": [ - "Actions on Objectives" - ], - "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", - "mitre_attack_id": [ - "T1003.002", - "T1003" - ], - "nist": [ - "DE.CM" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Processes.dest", - "Processes.user", - "Processes.parent_process_name", - "Processes.parent_process", - "Processes.original_file_name", - "Processes.process_name", - "Processes.process", - "Processes.process_id", - "Processes.parent_process_path", - "Processes.process_path", - "Processes.parent_process_id" - ], - "risk_score": 90, - "security_domain": "endpoint", - "risk_severity": "high", - "mitre_attack_enrichments": [ - { - "mitre_attack_id": "T1003.002", - "mitre_attack_technique": "Security Account Manager", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "Dragonfly 2.0", - "GALLIUM", - "Ke3chang", - "Night Dragon", - "Threat Group-3390", - "Wizard Spider", - "menuPass" - ] - }, - { - "mitre_attack_id": "T1003", - "mitre_attack_technique": "OS Credential Dumping", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "APT28", - "APT32", - "APT39", - "Axiom", - "Frankenstein", - "Leviathan", - "Poseidon Group", - "Sowbug", - "Suckfly", - "Tonto Team" - ] - } - ] - }, - "macros": [ - { - "name": "process_reg", - "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", - "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" + "tags": { + "name": "Attempted Credential Dump From Registry via Reg exe", + "analytic_story": [ + "Credential Dumping", + "DarkSide Ransomware" + ], + "asset_type": "Endpoint", + "automated_detection_testing": "passed", + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "confidence": 100, + "context": [ + "Source:Endpoint", + "Stage:Credential Access" + ], + "dataset": [ + "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" + ], + "impact": 90, + "kill_chain_phases": [ + "Actions on Objectives" + ], + "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", + "mitre_attack_id": [ + "T1003.002", + "T1003" + ], + "nist": [ + "DE.CM" + ], + "observable": [ + { + "name": "user", + "type": "User", + "role": [ + "Victim" + ] + }, + { + "name": "dest", + "type": "Hostname", + "role": [ + "Victim" + ] + }, + { + "name": "parent_process_name", + "type": "Process", + "role": [ + "Parent Process" + ] + }, + { + "name": "process_name", + "type": "Process", + "role": [ + "Child Process" + ] + } + ], + "product": [ + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "required_fields": [ + "_time", + "Processes.dest", + "Processes.user", + "Processes.parent_process_name", + "Processes.parent_process", + "Processes.original_file_name", + "Processes.process_name", + "Processes.process", + "Processes.process_id", + "Processes.parent_process_path", + "Processes.process_path", + "Processes.parent_process_id" + ], + "risk_score": 90, + "security_domain": "endpoint", + "risk_severity": "high", + "supported_tas": [ + "Splunk_TA_microsoft_sysmon" + ], + "mitre_attack_enrichments": [ + { + "mitre_attack_id": "T1003.002", + "mitre_attack_technique": "Security Account Manager", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "Dragonfly 2.0", + "Ke3chang", + "Night Dragon", + "Soft Cell", + "Threat Group-3390", + "menuPass" + ] + }, + { + "mitre_attack_id": "T1003", + "mitre_attack_technique": "OS Credential Dumping", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "APT28", + "APT32", + "APT39", + "Axiom", + "Frankenstein", + "Leviathan", + "Poseidon Group", + "Sowbug", + "Suckfly" + ] + } + ] }, - { - "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", - "definition": "search *", - "description": "Update this macro to limit the output results to filter out false positives." - } - ], - "lookups": [], - "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", - "source": "detection" - } -] \ No newline at end of file + "macros": [ + { + "name": "process_reg", + "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", + "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" + }, + { + "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", + "definition": "search *", + "description": "Update this macro to limit the output results to filter out false positives." + } + ], + "lookups": [], + "cve_enrichment": [], + "splunk_app_enrichment": [ + { + "name": "Splunk Add-on for Sysmon", + "url": "https://splunkbase.splunk.com/app/5709" + } + ], + "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", + "source": "detection" + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups.json index f00e2e6914..9f243c1ad0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups.json @@ -1,9 +1,11 @@ -[ - { - "name": "previously_seen_aws_regions", - "description": "A place holder for a list of used AWS regions", - "filename": "previously_seen_aws_regions.csv", - "default_match": "false", - "min_matches": 1 - } -] \ No newline at end of file +{ + "lookups": [ + { + "name": "previously_seen_aws_regions", + "description": "A place holder for a list of used AWS regions", + "filename": "previously_seen_aws_regions.csv", + "default_match": "false", + "min_matches": 1 + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups_ref.json index f00e2e6914..9f243c1ad0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups_ref.json @@ -1,9 +1,11 @@ -[ - { - "name": "previously_seen_aws_regions", - "description": "A place holder for a list of used AWS regions", - "filename": "previously_seen_aws_regions.csv", - "default_match": "false", - "min_matches": 1 - } -] \ No newline at end of file +{ + "lookups": [ + { + "name": "previously_seen_aws_regions", + "description": "A place holder for a list of used AWS regions", + "filename": "previously_seen_aws_regions.csv", + "default_match": "false", + "min_matches": 1 + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros.json index 9715d58e8a..853fae7698 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros.json @@ -1,7 +1,9 @@ -[ - { - "name": "powershell", - "definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - } -] \ No newline at end of file +{ + "macros": [ + { + "name": "powershell", + "definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros_ref.json index 9715d58e8a..853fae7698 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros_ref.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros_ref.json @@ -1,7 +1,9 @@ -[ - { - "name": "powershell", - "definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - } -] \ No newline at end of file +{ + "macros": [ + { + "name": "powershell", + "definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task.json deleted file mode 100644 index ee305ea7ba..0000000000 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task.json +++ /dev/null @@ -1,67 +0,0 @@ -[ - { - "name": "Get Parent Process Info", - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "version": 2, - "date": "2019-02-28", - "author": "Bhavin Patel, Splunk", - "type": "Investigation", - "datamodel": [ - "Endpoint" - ], - "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", - "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", - "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "known_false_positives": "", - "references": [], - "tags": { - "analytic_story": [ - "Collection and Staging", - "Command and Control", - "DHS Report TA18-074A", - "Disabling Security Tools", - "Emotet Malware DHS Report TA18-201A ", - "Hidden Cobra Malware", - "Lateral Movement", - "Malicious PowerShell", - "Monitor for Unauthorized Software", - "Netsh Abuse", - "Orangeworm Attack Group", - "Phishing Payloads", - "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", - "Prohibited Traffic Allowed or Protocol Mismatch", - "Ransomware", - "SamSam Ransomware", - "Suspicious Command-Line Executions", - "Suspicious DNS Traffic", - "Suspicious MSHTA Activity", - "Suspicious WMI Use", - "Suspicious Windows Registry Activities", - "Unusual Processes", - "Windows Defense Evasion Tactics", - "Windows File Extension and Association Abuse", - "Windows Log Manipulation", - "Windows Persistence Techniques", - "Windows Privilege Escalation", - "Windows Service Abuse", - "DarkSide Ransomware" - ], - "product": [ - "Splunk Phantom" - ], - "required_fields": [ - "_time", - "Processes.user", - "Processes.parent_process_name", - "Processes.process_name", - "Processes.dest" - ], - "security_domain": "endpoint" - }, - "inputs": [ - "parent_process_name", - "dest" - ], - "lowercase_name": "get_parent_process_info" - } -] \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task_ref.json deleted file mode 100644 index ee305ea7ba..0000000000 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task_ref.json +++ /dev/null @@ -1,67 +0,0 @@ -[ - { - "name": "Get Parent Process Info", - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "version": 2, - "date": "2019-02-28", - "author": "Bhavin Patel, Splunk", - "type": "Investigation", - "datamodel": [ - "Endpoint" - ], - "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", - "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", - "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "known_false_positives": "", - "references": [], - "tags": { - "analytic_story": [ - "Collection and Staging", - "Command and Control", - "DHS Report TA18-074A", - "Disabling Security Tools", - "Emotet Malware DHS Report TA18-201A ", - "Hidden Cobra Malware", - "Lateral Movement", - "Malicious PowerShell", - "Monitor for Unauthorized Software", - "Netsh Abuse", - "Orangeworm Attack Group", - "Phishing Payloads", - "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", - "Prohibited Traffic Allowed or Protocol Mismatch", - "Ransomware", - "SamSam Ransomware", - "Suspicious Command-Line Executions", - "Suspicious DNS Traffic", - "Suspicious MSHTA Activity", - "Suspicious WMI Use", - "Suspicious Windows Registry Activities", - "Unusual Processes", - "Windows Defense Evasion Tactics", - "Windows File Extension and Association Abuse", - "Windows Log Manipulation", - "Windows Persistence Techniques", - "Windows Privilege Escalation", - "Windows Service Abuse", - "DarkSide Ransomware" - ], - "product": [ - "Splunk Phantom" - ], - "required_fields": [ - "_time", - "Processes.user", - "Processes.parent_process_name", - "Processes.process_name", - "Processes.dest" - ], - "security_domain": "endpoint" - }, - "inputs": [ - "parent_process_name", - "dest" - ], - "lowercase_name": "get_parent_process_info" - } -] \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json index 4ea3af6227..88eb2c5012 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json @@ -1,67 +1,69 @@ -[ - { - "name": "Get Parent Process Info", - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "version": 2, - "date": "2019-02-28", - "author": "Bhavin Patel, Splunk", - "type": "Investigation", - "datamodel": [ - "Endpoint" - ], - "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", - "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", - "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "known_false_positives": "", - "references": [], - "inputs": [ - "parent_process_name", - "dest" - ], - "tags": { - "analytic_story": [ - "Collection and Staging", - "Command and Control", - "DHS Report TA18-074A", - "Disabling Security Tools", - "Emotet Malware DHS Report TA18-201A ", - "Hidden Cobra Malware", - "Lateral Movement", - "Malicious PowerShell", - "Monitor for Unauthorized Software", - "Netsh Abuse", - "Orangeworm Attack Group", - "Phishing Payloads", - "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", - "Prohibited Traffic Allowed or Protocol Mismatch", - "Ransomware", - "SamSam Ransomware", - "Suspicious Command-Line Executions", - "Suspicious DNS Traffic", - "Suspicious MSHTA Activity", - "Suspicious WMI Use", - "Suspicious Windows Registry Activities", - "Unusual Processes", - "Windows Defense Evasion Tactics", - "Windows File Extension and Association Abuse", - "Windows Log Manipulation", - "Windows Persistence Techniques", - "Windows Privilege Escalation", - "Windows Service Abuse", - "DarkSide Ransomware" +{ + "response_tasks": [ + { + "name": "Get Parent Process Info", + "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", + "version": 2, + "date": "2019-02-28", + "author": "Bhavin Patel, Splunk", + "type": "Investigation", + "datamodel": [ + "Endpoint" ], - "product": [ - "Splunk Phantom" + "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", + "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", + "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", + "known_false_positives": "", + "references": [], + "inputs": [ + "parent_process_name", + "dest" ], - "required_fields": [ - "_time", - "Processes.user", - "Processes.parent_process_name", - "Processes.process_name", - "Processes.dest" - ], - "security_domain": "endpoint" - }, - "lowercase_name": "get_parent_process_info" - } -] \ No newline at end of file + "tags": { + "analytic_story": [ + "Collection and Staging", + "Command and Control", + "DHS Report TA18-074A", + "Disabling Security Tools", + "Emotet Malware DHS Report TA18-201A ", + "Hidden Cobra Malware", + "Lateral Movement", + "Malicious PowerShell", + "Monitor for Unauthorized Software", + "Netsh Abuse", + "Orangeworm Attack Group", + "Phishing Payloads", + "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", + "Prohibited Traffic Allowed or Protocol Mismatch", + "Ransomware", + "SamSam Ransomware", + "Suspicious Command-Line Executions", + "Suspicious DNS Traffic", + "Suspicious MSHTA Activity", + "Suspicious WMI Use", + "Suspicious Windows Registry Activities", + "Unusual Processes", + "Windows Defense Evasion Tactics", + "Windows File Extension and Association Abuse", + "Windows Log Manipulation", + "Windows Persistence Techniques", + "Windows Privilege Escalation", + "Windows Service Abuse", + "DarkSide Ransomware" + ], + "product": [ + "Splunk Phantom" + ], + "required_fields": [ + "_time", + "Processes.user", + "Processes.parent_process_name", + "Processes.process_name", + "Processes.dest" + ], + "security_domain": "endpoint" + }, + "lowercase_name": "get_parent_process_info" + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json new file mode 100644 index 0000000000..88eb2c5012 --- /dev/null +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json @@ -0,0 +1,69 @@ +{ + "response_tasks": [ + { + "name": "Get Parent Process Info", + "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", + "version": 2, + "date": "2019-02-28", + "author": "Bhavin Patel, Splunk", + "type": "Investigation", + "datamodel": [ + "Endpoint" + ], + "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", + "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", + "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", + "known_false_positives": "", + "references": [], + "inputs": [ + "parent_process_name", + "dest" + ], + "tags": { + "analytic_story": [ + "Collection and Staging", + "Command and Control", + "DHS Report TA18-074A", + "Disabling Security Tools", + "Emotet Malware DHS Report TA18-201A ", + "Hidden Cobra Malware", + "Lateral Movement", + "Malicious PowerShell", + "Monitor for Unauthorized Software", + "Netsh Abuse", + "Orangeworm Attack Group", + "Phishing Payloads", + "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", + "Prohibited Traffic Allowed or Protocol Mismatch", + "Ransomware", + "SamSam Ransomware", + "Suspicious Command-Line Executions", + "Suspicious DNS Traffic", + "Suspicious MSHTA Activity", + "Suspicious WMI Use", + "Suspicious Windows Registry Activities", + "Unusual Processes", + "Windows Defense Evasion Tactics", + "Windows File Extension and Association Abuse", + "Windows Log Manipulation", + "Windows Persistence Techniques", + "Windows Privilege Escalation", + "Windows Service Abuse", + "DarkSide Ransomware" + ], + "product": [ + "Splunk Phantom" + ], + "required_fields": [ + "_time", + "Processes.user", + "Processes.parent_process_name", + "Processes.process_name", + "Processes.dest" + ], + "security_domain": "endpoint" + }, + "lowercase_name": "get_parent_process_info" + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index 208de8a43b..faef64b1e5 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -1,506 +1,504 @@ -[ - { - "name": "DarkSide Ransomware", - "id": "507edc74-13d5-4339-878e-b9114ded1f35", - "version": 1, - "date": "2021-05-12", - "author": "Bhavin Patel, Splunk", - "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", - "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", - "references": [ - "https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", - "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html" - ], - "tags": { +{ + "stories": [ + { "name": "DarkSide Ransomware", - "analytic_story": "DarkSide Ransomware", - "category": [ - "Malware" + "id": "507edc74-13d5-4339-878e-b9114ded1f35", + "version": 1, + "date": "2021-05-12", + "author": "Bhavin Patel, Splunk", + "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", + "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", + "references": [ + "https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", + "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html" ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "usecase": "Advanced Threat Detection", - "mitre_attack_enrichments": [ - { - "mitre_attack_id": "T1003.002", - "mitre_attack_technique": "Security Account Manager", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "Dragonfly 2.0", - "GALLIUM", - "Ke3chang", - "Night Dragon", - "Threat Group-3390", - "Wizard Spider", - "menuPass" - ] - }, - { - "mitre_attack_id": "T1003", - "mitre_attack_technique": "OS Credential Dumping", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "APT28", - "APT32", - "APT39", - "Axiom", - "Frankenstein", - "Leviathan", - "Poseidon Group", - "Sowbug", - "Suckfly", - "Tonto Team" - ] - } - ], - "mitre_attack_tactics": [ - "Credential Access" - ], - "datamodels": [ - "Endpoint" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ] - }, - "detection_names": [ - "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule" - ], - "investigation_names": [ - "ESCU - Get Parent Process Info - Response Task" - ], - "baseline_names": [ - "ESCU - Baseline Of Cloud Instances Launched" - ], - "author_company": "Splunk", - "author_name": "Bhavin Patel", - "detections": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", - "version": 6, - "date": "2021-09-16", - "author": "Patrick Bareiss, Splunk", - "type": "TTP", - "datamodel": [ - "Endpoint" + "tags": { + "name": "DarkSide Ransomware", + "analytic_story": "DarkSide Ransomware", + "category": [ + "Malware" ], - "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", - "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", - "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", - "known_false_positives": "None identified.", - "references": [ - "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" + "product": [ + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" ], - "tags": { - "name": "Attempted Credential Dump From Registry via Reg exe", - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" - ], - "asset_type": "Endpoint", - "automated_detection_testing": "passed", - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "confidence": 100, - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "dataset": [ - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" - ], - "impact": 90, - "kill_chain_phases": [ - "Actions on Objectives" - ], - "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", - "mitre_attack_id": [ - "T1003.002", - "T1003" - ], - "nist": [ - "DE.CM" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Processes.dest", - "Processes.user", - "Processes.parent_process_name", - "Processes.parent_process", - "Processes.original_file_name", - "Processes.process_name", - "Processes.process", - "Processes.process_id", - "Processes.parent_process_path", - "Processes.process_path", - "Processes.parent_process_id" - ], - "risk_score": 90, - "security_domain": "endpoint", - "risk_severity": "high", - "supported_tas": [ - "Splunk_TA_microsoft_sysmon" - ], - "mitre_attack_enrichments": [ - { - "mitre_attack_id": "T1003.002", - "mitre_attack_technique": "Security Account Manager", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "Dragonfly 2.0", - "GALLIUM", - "Ke3chang", - "Night Dragon", - "Threat Group-3390", - "Wizard Spider", - "menuPass" - ] - }, - { - "mitre_attack_id": "T1003", - "mitre_attack_technique": "OS Credential Dumping", - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "APT28", - "APT32", - "APT39", - "Axiom", - "Frankenstein", - "Leviathan", - "Poseidon Group", - "Sowbug", - "Suckfly", - "Tonto Team" - ] - } - ] - }, - "deprecated": false, - "experimental": false, - "deployment": { - "name": "ESCU Default Configuration TTP", - "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", - "date": "2021-12-21", - "author": "Patrick Bareiss", - "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m", - "schedule_window": "auto" - }, - "notable": { - "rule_description": "%description%", - "rule_title": "%name%", - "nes_fields": [ - "user", - "dest" + "usecase": "Advanced Threat Detection", + "mitre_attack_enrichments": [ + { + "mitre_attack_id": "T1003.002", + "mitre_attack_technique": "Security Account Manager", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "Dragonfly 2.0", + "Ke3chang", + "Night Dragon", + "Soft Cell", + "Threat Group-3390", + "menuPass" ] }, - "rba": { - "enabled": "true" - }, - "tags": { - "type": "TTP" - } - }, - "annotations": { - "mitre_attack": [ - "T1003.002", - "T1003" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ], - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "nist": [ - "DE.CM" - ], - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "impact": 90, - "confidence": 100 - }, - "risk": [ { - "risk_object_type": "user", - "risk_object_field": "user", - "risk_score": 90 - }, - { - "risk_object_type": "system", - "risk_object_field": "dest", - "risk_score": 90 - }, - { - "threat_object_field": "parent_process_name", - "threat_object_type": "process" - }, - { - "threat_object_field": "process_name", - "threat_object_type": "process" - } - ], - "playbooks": [ - { - "name": "Ransomware Investigate and Contain", - "id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63", - "version": 1, - "date": "2018-02-04", - "author": "Philip Royer, Splunk", - "type": "Response", - "description": "This playbook investigates and contains ransomware detected on endpoints.", - "how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.", - "playbook": "ransomware_investigate_and_contain", - "references": [], - "app_list": [ - "Carbon Black Response", - "LDAP", - "Palo Alto Networks Firewall", - "WildFire", - "Cylance" + "mitre_attack_id": "T1003", + "mitre_attack_technique": "OS Credential Dumping", + "mitre_attack_tactics": [ + "Credential Access" ], - "tags": { - "analytic_story": [ - "Ransomware" - ], - "detections": [ - "Attempted Credential Dump From Registry via Reg exe" - ], - "platform_tags": [ - "Ransomware", - "Response" - ], - "playbook_fields": [ - "ComputerName", - "Username" - ], - "product": [ - "Splunk SOAR" - ], - "detection_objects": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe", - "path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" - } - ] - } + "mitre_attack_groups": [ + "APT28", + "APT32", + "APT39", + "Axiom", + "Frankenstein", + "Leviathan", + "Poseidon Group", + "Sowbug", + "Suckfly" + ] } ], - "baselines": [], - "mappings": { - "mitre_attack": [ - "T1003.002", - "T1003" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ], - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "nist": [ - "DE.CM" - ] - }, - "test": { - "name": "Attempted Credential Dump From Registry via Reg exe Unit Test", - "tests": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml", - "pass_condition": "| stats count | where count > 0", - "earliest_time": "-24h", - "latest_time": "now", - "attack_data": [ - { - "file_name": "windows-sysmon.log", - "data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log", - "source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", - "sourcetype": "xmlwineventlog" - } - ] - } - ] - }, - "macros": [ - { - "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", - "definition": "search *", - "description": "Update this macro to limit the output results to filter out false positives." - } + "mitre_attack_tactics": [ + "Credential Access" ], - "lookups": [], - "cve_enrichment": [], - "splunk_app_enrichment": [ - { - "name": "Splunk Add-on for Sysmon", - "url": "https://splunkbase.splunk.com/app/5709" - } - ], - "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", - "source": "detection" - } - ], - "investigations": [ - { - "name": "Get Parent Process Info", - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "version": 2, - "date": "2019-02-28", - "author": "Bhavin Patel, Splunk", - "type": "Investigation", - "datamodel": [ + "datamodels": [ "Endpoint" ], - "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", - "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", - "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "known_false_positives": "", - "references": [], - "inputs": [ - "parent_process_name", - "dest" - ], - "tags": { - "analytic_story": [ - "Collection and Staging", - "Command and Control", - "DHS Report TA18-074A", - "Disabling Security Tools", - "Emotet Malware DHS Report TA18-201A ", - "Hidden Cobra Malware", - "Lateral Movement", - "Malicious PowerShell", - "Monitor for Unauthorized Software", - "Netsh Abuse", - "Orangeworm Attack Group", - "Phishing Payloads", - "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", - "Prohibited Traffic Allowed or Protocol Mismatch", - "Ransomware", - "SamSam Ransomware", - "Suspicious Command-Line Executions", - "Suspicious DNS Traffic", - "Suspicious MSHTA Activity", - "Suspicious WMI Use", - "Suspicious Windows Registry Activities", - "Unusual Processes", - "Windows Defense Evasion Tactics", - "Windows File Extension and Association Abuse", - "Windows Log Manipulation", - "Windows Persistence Techniques", - "Windows Privilege Escalation", - "Windows Service Abuse", - "DarkSide Ransomware" + "kill_chain_phases": [ + "Actions on Objectives" + ] + }, + "detection_names": [ + "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule" + ], + "investigation_names": [ + "ESCU - Get Parent Process Info - Response Task" + ], + "baseline_names": [ + "ESCU - Baseline Of Cloud Instances Launched" + ], + "author_company": "Splunk", + "author_name": "Bhavin Patel", + "detections": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", + "version": 6, + "date": "2021-09-16", + "author": "Patrick Bareiss, Splunk", + "type": "TTP", + "datamodel": [ + "Endpoint" ], - "product": [ - "Splunk Phantom" + "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", + "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", + "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", + "known_false_positives": "None identified.", + "references": [ + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" ], - "required_fields": [ - "_time", - "Processes.user", - "Processes.parent_process_name", - "Processes.process_name", - "Processes.dest" + "tags": { + "name": "Attempted Credential Dump From Registry via Reg exe", + "analytic_story": [ + "Credential Dumping", + "DarkSide Ransomware" + ], + "asset_type": "Endpoint", + "automated_detection_testing": "passed", + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "confidence": 100, + "context": [ + "Source:Endpoint", + "Stage:Credential Access" + ], + "dataset": [ + "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" + ], + "impact": 90, + "kill_chain_phases": [ + "Actions on Objectives" + ], + "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", + "mitre_attack_id": [ + "T1003.002", + "T1003" + ], + "nist": [ + "DE.CM" + ], + "observable": [ + { + "name": "user", + "type": "User", + "role": [ + "Victim" + ] + }, + { + "name": "dest", + "type": "Hostname", + "role": [ + "Victim" + ] + }, + { + "name": "parent_process_name", + "type": "Process", + "role": [ + "Parent Process" + ] + }, + { + "name": "process_name", + "type": "Process", + "role": [ + "Child Process" + ] + } + ], + "product": [ + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "required_fields": [ + "_time", + "Processes.dest", + "Processes.user", + "Processes.parent_process_name", + "Processes.parent_process", + "Processes.original_file_name", + "Processes.process_name", + "Processes.process", + "Processes.process_id", + "Processes.parent_process_path", + "Processes.process_path", + "Processes.parent_process_id" + ], + "risk_score": 90, + "security_domain": "endpoint", + "risk_severity": "high", + "supported_tas": [ + "Splunk_TA_microsoft_sysmon" + ], + "mitre_attack_enrichments": [ + { + "mitre_attack_id": "T1003.002", + "mitre_attack_technique": "Security Account Manager", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "Dragonfly 2.0", + "Ke3chang", + "Night Dragon", + "Soft Cell", + "Threat Group-3390", + "menuPass" + ] + }, + { + "mitre_attack_id": "T1003", + "mitre_attack_technique": "OS Credential Dumping", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "APT28", + "APT32", + "APT39", + "Axiom", + "Frankenstein", + "Leviathan", + "Poseidon Group", + "Sowbug", + "Suckfly" + ] + } + ] + }, + "deprecated": false, + "experimental": false, + "deployment": { + "name": "ESCU Default Configuration TTP", + "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", + "date": "2021-12-21", + "author": "Patrick Bareiss", + "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m", + "schedule_window": "auto" + }, + "notable": { + "rule_description": "%description%", + "rule_title": "%name%", + "nes_fields": [ + "user", + "dest" + ] + }, + "rba": { + "enabled": "true" + }, + "tags": { + "type": "TTP" + } + }, + "annotations": { + "mitre_attack": [ + "T1003.002", + "T1003" + ], + "kill_chain_phases": [ + "Actions on Objectives" + ], + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "nist": [ + "DE.CM" + ], + "analytic_story": [ + "Credential Dumping", + "DarkSide Ransomware" + ], + "observable": [ + { + "name": "user", + "type": "User", + "role": [ + "Victim" + ] + }, + { + "name": "dest", + "type": "Hostname", + "role": [ + "Victim" + ] + }, + { + "name": "parent_process_name", + "type": "Process", + "role": [ + "Parent Process" + ] + }, + { + "name": "process_name", + "type": "Process", + "role": [ + "Child Process" + ] + } + ], + "context": [ + "Source:Endpoint", + "Stage:Credential Access" + ], + "impact": 90, + "confidence": 100 + }, + "risk": [ + { + "risk_object_type": "user", + "risk_object_field": "user", + "risk_score": 90 + }, + { + "risk_object_type": "system", + "risk_object_field": "dest", + "risk_score": 90 + }, + { + "threat_object_field": "parent_process_name", + "threat_object_type": "process" + }, + { + "threat_object_field": "process_name", + "threat_object_type": "process" + } ], - "security_domain": "endpoint" - }, - "lowercase_name": "get_parent_process_info" - } - ] - } -] \ No newline at end of file + "playbooks": [ + { + "name": "Ransomware Investigate and Contain", + "id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63", + "version": 1, + "date": "2018-02-04", + "author": "Philip Royer, Splunk", + "type": "Response", + "description": "This playbook investigates and contains ransomware detected on endpoints.", + "how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.", + "playbook": "ransomware_investigate_and_contain", + "references": [], + "app_list": [ + "Carbon Black Response", + "LDAP", + "Palo Alto Networks Firewall", + "WildFire", + "Cylance" + ], + "tags": { + "analytic_story": [ + "Ransomware" + ], + "detections": [ + "Attempted Credential Dump From Registry via Reg exe" + ], + "platform_tags": [ + "Ransomware", + "Response" + ], + "playbook_fields": [ + "ComputerName", + "Username" + ], + "product": [ + "Splunk SOAR" + ], + "detection_objects": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe", + "path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" + } + ] + } + } + ], + "baselines": [], + "mappings": { + "mitre_attack": [ + "T1003.002", + "T1003" + ], + "kill_chain_phases": [ + "Actions on Objectives" + ], + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "nist": [ + "DE.CM" + ] + }, + "test": { + "name": "Attempted Credential Dump From Registry via Reg exe Unit Test", + "tests": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml", + "pass_condition": "| stats count | where count > 0", + "earliest_time": "-24h", + "latest_time": "now", + "attack_data": [ + { + "file_name": "windows-sysmon.log", + "data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log", + "source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", + "sourcetype": "xmlwineventlog" + } + ] + } + ] + }, + "macros": [ + { + "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", + "definition": "search *", + "description": "Update this macro to limit the output results to filter out false positives." + } + ], + "lookups": [], + "cve_enrichment": [], + "splunk_app_enrichment": [ + { + "name": "Splunk Add-on for Sysmon", + "url": "https://splunkbase.splunk.com/app/5709" + } + ], + "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", + "source": "detection" + } + ], + "investigations": [ + { + "name": "Get Parent Process Info", + "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", + "version": 2, + "date": "2019-02-28", + "author": "Bhavin Patel, Splunk", + "type": "Investigation", + "datamodel": [ + "Endpoint" + ], + "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", + "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", + "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", + "known_false_positives": "", + "references": [], + "inputs": [ + "parent_process_name", + "dest" + ], + "tags": { + "analytic_story": [ + "Collection and Staging", + "Command and Control", + "DHS Report TA18-074A", + "Disabling Security Tools", + "Emotet Malware DHS Report TA18-201A ", + "Hidden Cobra Malware", + "Lateral Movement", + "Malicious PowerShell", + "Monitor for Unauthorized Software", + "Netsh Abuse", + "Orangeworm Attack Group", + "Phishing Payloads", + "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", + "Prohibited Traffic Allowed or Protocol Mismatch", + "Ransomware", + "SamSam Ransomware", + "Suspicious Command-Line Executions", + "Suspicious DNS Traffic", + "Suspicious MSHTA Activity", + "Suspicious WMI Use", + "Suspicious Windows Registry Activities", + "Unusual Processes", + "Windows Defense Evasion Tactics", + "Windows File Extension and Association Abuse", + "Windows Log Manipulation", + "Windows Persistence Techniques", + "Windows Privilege Escalation", + "Windows Service Abuse", + "DarkSide Ransomware" + ], + "product": [ + "Splunk Phantom" + ], + "required_fields": [ + "_time", + "Processes.user", + "Processes.parent_process_name", + "Processes.process_name", + "Processes.dest" + ], + "security_domain": "endpoint" + }, + "lowercase_name": "get_parent_process_info" + } + ] + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories_ref.json new file mode 100644 index 0000000000..faef64b1e5 --- /dev/null +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories_ref.json @@ -0,0 +1,504 @@ +{ + "stories": [ + { + "name": "DarkSide Ransomware", + "id": "507edc74-13d5-4339-878e-b9114ded1f35", + "version": 1, + "date": "2021-05-12", + "author": "Bhavin Patel, Splunk", + "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", + "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", + "references": [ + "https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", + "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html" + ], + "tags": { + "name": "DarkSide Ransomware", + "analytic_story": "DarkSide Ransomware", + "category": [ + "Malware" + ], + "product": [ + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "usecase": "Advanced Threat Detection", + "mitre_attack_enrichments": [ + { + "mitre_attack_id": "T1003.002", + "mitre_attack_technique": "Security Account Manager", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "Dragonfly 2.0", + "Ke3chang", + "Night Dragon", + "Soft Cell", + "Threat Group-3390", + "menuPass" + ] + }, + { + "mitre_attack_id": "T1003", + "mitre_attack_technique": "OS Credential Dumping", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "APT28", + "APT32", + "APT39", + "Axiom", + "Frankenstein", + "Leviathan", + "Poseidon Group", + "Sowbug", + "Suckfly" + ] + } + ], + "mitre_attack_tactics": [ + "Credential Access" + ], + "datamodels": [ + "Endpoint" + ], + "kill_chain_phases": [ + "Actions on Objectives" + ] + }, + "detection_names": [ + "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule" + ], + "investigation_names": [ + "ESCU - Get Parent Process Info - Response Task" + ], + "baseline_names": [ + "ESCU - Baseline Of Cloud Instances Launched" + ], + "author_company": "Splunk", + "author_name": "Bhavin Patel", + "detections": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", + "version": 6, + "date": "2021-09-16", + "author": "Patrick Bareiss, Splunk", + "type": "TTP", + "datamodel": [ + "Endpoint" + ], + "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", + "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", + "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", + "known_false_positives": "None identified.", + "references": [ + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" + ], + "tags": { + "name": "Attempted Credential Dump From Registry via Reg exe", + "analytic_story": [ + "Credential Dumping", + "DarkSide Ransomware" + ], + "asset_type": "Endpoint", + "automated_detection_testing": "passed", + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "confidence": 100, + "context": [ + "Source:Endpoint", + "Stage:Credential Access" + ], + "dataset": [ + "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" + ], + "impact": 90, + "kill_chain_phases": [ + "Actions on Objectives" + ], + "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", + "mitre_attack_id": [ + "T1003.002", + "T1003" + ], + "nist": [ + "DE.CM" + ], + "observable": [ + { + "name": "user", + "type": "User", + "role": [ + "Victim" + ] + }, + { + "name": "dest", + "type": "Hostname", + "role": [ + "Victim" + ] + }, + { + "name": "parent_process_name", + "type": "Process", + "role": [ + "Parent Process" + ] + }, + { + "name": "process_name", + "type": "Process", + "role": [ + "Child Process" + ] + } + ], + "product": [ + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Cloud" + ], + "required_fields": [ + "_time", + "Processes.dest", + "Processes.user", + "Processes.parent_process_name", + "Processes.parent_process", + "Processes.original_file_name", + "Processes.process_name", + "Processes.process", + "Processes.process_id", + "Processes.parent_process_path", + "Processes.process_path", + "Processes.parent_process_id" + ], + "risk_score": 90, + "security_domain": "endpoint", + "risk_severity": "high", + "supported_tas": [ + "Splunk_TA_microsoft_sysmon" + ], + "mitre_attack_enrichments": [ + { + "mitre_attack_id": "T1003.002", + "mitre_attack_technique": "Security Account Manager", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "Dragonfly 2.0", + "Ke3chang", + "Night Dragon", + "Soft Cell", + "Threat Group-3390", + "menuPass" + ] + }, + { + "mitre_attack_id": "T1003", + "mitre_attack_technique": "OS Credential Dumping", + "mitre_attack_tactics": [ + "Credential Access" + ], + "mitre_attack_groups": [ + "APT28", + "APT32", + "APT39", + "Axiom", + "Frankenstein", + "Leviathan", + "Poseidon Group", + "Sowbug", + "Suckfly" + ] + } + ] + }, + "deprecated": false, + "experimental": false, + "deployment": { + "name": "ESCU Default Configuration TTP", + "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", + "date": "2021-12-21", + "author": "Patrick Bareiss", + "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m", + "schedule_window": "auto" + }, + "notable": { + "rule_description": "%description%", + "rule_title": "%name%", + "nes_fields": [ + "user", + "dest" + ] + }, + "rba": { + "enabled": "true" + }, + "tags": { + "type": "TTP" + } + }, + "annotations": { + "mitre_attack": [ + "T1003.002", + "T1003" + ], + "kill_chain_phases": [ + "Actions on Objectives" + ], + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "nist": [ + "DE.CM" + ], + "analytic_story": [ + "Credential Dumping", + "DarkSide Ransomware" + ], + "observable": [ + { + "name": "user", + "type": "User", + "role": [ + "Victim" + ] + }, + { + "name": "dest", + "type": "Hostname", + "role": [ + "Victim" + ] + }, + { + "name": "parent_process_name", + "type": "Process", + "role": [ + "Parent Process" + ] + }, + { + "name": "process_name", + "type": "Process", + "role": [ + "Child Process" + ] + } + ], + "context": [ + "Source:Endpoint", + "Stage:Credential Access" + ], + "impact": 90, + "confidence": 100 + }, + "risk": [ + { + "risk_object_type": "user", + "risk_object_field": "user", + "risk_score": 90 + }, + { + "risk_object_type": "system", + "risk_object_field": "dest", + "risk_score": 90 + }, + { + "threat_object_field": "parent_process_name", + "threat_object_type": "process" + }, + { + "threat_object_field": "process_name", + "threat_object_type": "process" + } + ], + "playbooks": [ + { + "name": "Ransomware Investigate and Contain", + "id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63", + "version": 1, + "date": "2018-02-04", + "author": "Philip Royer, Splunk", + "type": "Response", + "description": "This playbook investigates and contains ransomware detected on endpoints.", + "how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.", + "playbook": "ransomware_investigate_and_contain", + "references": [], + "app_list": [ + "Carbon Black Response", + "LDAP", + "Palo Alto Networks Firewall", + "WildFire", + "Cylance" + ], + "tags": { + "analytic_story": [ + "Ransomware" + ], + "detections": [ + "Attempted Credential Dump From Registry via Reg exe" + ], + "platform_tags": [ + "Ransomware", + "Response" + ], + "playbook_fields": [ + "ComputerName", + "Username" + ], + "product": [ + "Splunk SOAR" + ], + "detection_objects": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe", + "path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" + } + ] + } + } + ], + "baselines": [], + "mappings": { + "mitre_attack": [ + "T1003.002", + "T1003" + ], + "kill_chain_phases": [ + "Actions on Objectives" + ], + "cis20": [ + "CIS 3", + "CIS 5", + "CIS 16" + ], + "nist": [ + "DE.CM" + ] + }, + "test": { + "name": "Attempted Credential Dump From Registry via Reg exe Unit Test", + "tests": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml", + "pass_condition": "| stats count | where count > 0", + "earliest_time": "-24h", + "latest_time": "now", + "attack_data": [ + { + "file_name": "windows-sysmon.log", + "data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log", + "source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", + "sourcetype": "xmlwineventlog" + } + ] + } + ] + }, + "macros": [ + { + "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", + "definition": "search *", + "description": "Update this macro to limit the output results to filter out false positives." + } + ], + "lookups": [], + "cve_enrichment": [], + "splunk_app_enrichment": [ + { + "name": "Splunk Add-on for Sysmon", + "url": "https://splunkbase.splunk.com/app/5709" + } + ], + "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", + "source": "detection" + } + ], + "investigations": [ + { + "name": "Get Parent Process Info", + "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", + "version": 2, + "date": "2019-02-28", + "author": "Bhavin Patel, Splunk", + "type": "Investigation", + "datamodel": [ + "Endpoint" + ], + "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", + "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", + "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", + "known_false_positives": "", + "references": [], + "inputs": [ + "parent_process_name", + "dest" + ], + "tags": { + "analytic_story": [ + "Collection and Staging", + "Command and Control", + "DHS Report TA18-074A", + "Disabling Security Tools", + "Emotet Malware DHS Report TA18-201A ", + "Hidden Cobra Malware", + "Lateral Movement", + "Malicious PowerShell", + "Monitor for Unauthorized Software", + "Netsh Abuse", + "Orangeworm Attack Group", + "Phishing Payloads", + "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", + "Prohibited Traffic Allowed or Protocol Mismatch", + "Ransomware", + "SamSam Ransomware", + "Suspicious Command-Line Executions", + "Suspicious DNS Traffic", + "Suspicious MSHTA Activity", + "Suspicious WMI Use", + "Suspicious Windows Registry Activities", + "Unusual Processes", + "Windows Defense Evasion Tactics", + "Windows File Extension and Association Abuse", + "Windows Log Manipulation", + "Windows Persistence Techniques", + "Windows Privilege Escalation", + "Windows Service Abuse", + "DarkSide Ransomware" + ], + "product": [ + "Splunk Phantom" + ], + "required_fields": [ + "_time", + "Processes.user", + "Processes.parent_process_name", + "Processes.process_name", + "Processes.dest" + ], + "security_domain": "endpoint" + }, + "lowercase_name": "get_parent_process_info" + } + ] + } + ] +} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story.json deleted file mode 100644 index 8a3f06e61a..0000000000 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story.json +++ /dev/null @@ -1,430 +0,0 @@ -[ - { - "name": "DarkSide Ransomware", - "id": "507edc74-13d5-4339-878e-b9114ded1f35", - "version": 1, - "date": "2021-05-12", - "author": "Bhavin Patel, Splunk", - "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", - "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", - "references": [ - "https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", - "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html" - ], - "tags": { - "name": "DarkSide Ransomware", - "analytic_story": "DarkSide Ransomware", - "category": [ - "Malware" - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "usecase": "Advanced Threat Detection" - }, - "detection_names": [ - "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule" - ], - "investigation_names": [ - "ESCU - Get Parent Process Info - Response Task" - ], - "baseline_names": [ - "ESCU - Baseline Of Cloud Instances Launched" - ], - "author_company": "Splunk", - "author_name": "Bhavin Patel", - "detections": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", - "version": 6, - "date": "2021-09-16", - "author": "Patrick Bareiss, Splunk", - "type": "TTP", - "datamodel": [ - "Endpoint" - ], - "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", - "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", - "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", - "known_false_positives": "None identified.", - "references": [ - "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" - ], - "tags": { - "name": "Attempted Credential Dump From Registry via Reg exe", - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" - ], - "asset_type": "Endpoint", - "automated_detection_testing": "passed", - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "confidence": 100, - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "dataset": [ - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" - ], - "impact": 90, - "kill_chain_phases": [ - "Actions on Objectives" - ], - "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", - "mitre_attack_id": [ - "T1003.002", - "T1003" - ], - "nist": [ - "DE.CM" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Processes.dest", - "Processes.user", - "Processes.parent_process_name", - "Processes.parent_process", - "Processes.original_file_name", - "Processes.process_name", - "Processes.process", - "Processes.process_id", - "Processes.parent_process_path", - "Processes.process_path", - "Processes.parent_process_id" - ], - "risk_score": 90, - "security_domain": "endpoint", - "risk_severity": "high", - "mitre_attack_techniques": [ - "Security Account Manager", - "OS Credential Dumping" - ], - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "Wizard Spider", - "Threat Group-3390", - "Ke3chang", - "GALLIUM", - "Night Dragon", - "Dragonfly 2.0", - "menuPass", - "Tonto Team", - "APT39", - "Frankenstein", - "APT32", - "APT28", - "Leviathan", - "Sowbug", - "Suckfly", - "Poseidon Group", - "Axiom" - ] - }, - "deprecated": false, - "experimental": false, - "deployment": { - "name": "ESCU Default Configuration TTP", - "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", - "date": "2021-12-21", - "author": "Patrick Bareiss", - "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m", - "schedule_window": "auto" - }, - "notable": { - "rule_description": "%description%", - "rule_title": "%name%", - "nes_fields": [ - "user", - "dest" - ] - }, - "rba": { - "enabled": "true" - }, - "tags": { - "type": "TTP" - } - }, - "annotations": { - "mitre_attack": [ - "T1003.002", - "T1003" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ], - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "nist": [ - "DE.CM" - ], - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "impact": 90, - "confidence": 100 - }, - "risk": [ - { - "risk_object_type": "user", - "risk_object_field": "user", - "risk_score": 90 - }, - { - "risk_object_type": "system", - "risk_object_field": "dest", - "risk_score": 90 - }, - { - "threat_object_field": "parent_process_name", - "threat_object_type": "process" - }, - { - "threat_object_field": "process_name", - "threat_object_type": "process" - } - ], - "playbooks": [ - { - "name": "Ransomware Investigate and Contain", - "id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63", - "version": 1, - "date": "2018-02-04", - "author": "Philip Royer, Splunk", - "type": "Response", - "description": "This playbook investigates and contains ransomware detected on endpoints.", - "how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.", - "playbook": "ransomware_investigate_and_contain", - "references": [], - "app_list": [ - "Carbon Black Response", - "LDAP", - "Palo Alto Networks Firewall", - "WildFire", - "Cylance" - ], - "tags": { - "analytic_story": [ - "Ransomware" - ], - "detections": [ - "Conti Common Exec parameter", - "Attempted Credential Dump From Registry via Reg exe" - ], - "platform_tags": [ - "Ransomware", - "Response" - ], - "playbook_fields": [ - "ComputerName", - "Username" - ], - "product": [ - "Splunk SOAR" - ] - } - } - ], - "baselines": [], - "mappings": { - "mitre_attack": [ - "T1003.002", - "T1003" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ], - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "nist": [ - "DE.CM" - ] - }, - "test": { - "name": "Attempted Credential Dump From Registry via Reg exe Unit Test", - "tests": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml", - "pass_condition": "| stats count | where count > 0", - "earliest_time": "-24h", - "latest_time": "now", - "attack_data": [ - { - "file_name": "windows-sysmon.log", - "data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log", - "source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", - "sourcetype": "xmlwineventlog" - } - ] - } - ] - }, - "macros": [ - { - "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", - "definition": "search *", - "description": "Update this macro to limit the output results to filter out false positives." - } - ] - } - ], - "investigations": [ - { - "name": "Get Parent Process Info", - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "version": 2, - "date": "2019-02-28", - "author": "Bhavin Patel, Splunk", - "type": "Investigation", - "datamodel": [ - "Endpoint" - ], - "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", - "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", - "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "known_false_positives": "", - "references": [], - "tags": { - "analytic_story": [ - "Collection and Staging", - "Command and Control", - "DHS Report TA18-074A", - "Disabling Security Tools", - "Emotet Malware DHS Report TA18-201A ", - "Hidden Cobra Malware", - "Lateral Movement", - "Malicious PowerShell", - "Monitor for Unauthorized Software", - "Netsh Abuse", - "Orangeworm Attack Group", - "Phishing Payloads", - "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", - "Prohibited Traffic Allowed or Protocol Mismatch", - "Ransomware", - "SamSam Ransomware", - "Suspicious Command-Line Executions", - "Suspicious DNS Traffic", - "Suspicious MSHTA Activity", - "Suspicious WMI Use", - "Suspicious Windows Registry Activities", - "Unusual Processes", - "Windows Defense Evasion Tactics", - "Windows File Extension and Association Abuse", - "Windows Log Manipulation", - "Windows Persistence Techniques", - "Windows Privilege Escalation", - "Windows Service Abuse", - "DarkSide Ransomware" - ], - "product": [ - "Splunk Phantom" - ], - "required_fields": [ - "_time", - "Processes.user", - "Processes.parent_process_name", - "Processes.process_name", - "Processes.dest" - ], - "security_domain": "endpoint" - }, - "inputs": [ - "parent_process_name", - "dest" - ], - "lowercase_name": "get_parent_process_info" - } - ] - } -] \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story_ref.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story_ref.json deleted file mode 100644 index 8a3f06e61a..0000000000 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story_ref.json +++ /dev/null @@ -1,430 +0,0 @@ -[ - { - "name": "DarkSide Ransomware", - "id": "507edc74-13d5-4339-878e-b9114ded1f35", - "version": 1, - "date": "2021-05-12", - "author": "Bhavin Patel, Splunk", - "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", - "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", - "references": [ - "https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", - "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html" - ], - "tags": { - "name": "DarkSide Ransomware", - "analytic_story": "DarkSide Ransomware", - "category": [ - "Malware" - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "usecase": "Advanced Threat Detection" - }, - "detection_names": [ - "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule" - ], - "investigation_names": [ - "ESCU - Get Parent Process Info - Response Task" - ], - "baseline_names": [ - "ESCU - Baseline Of Cloud Instances Launched" - ], - "author_company": "Splunk", - "author_name": "Bhavin Patel", - "detections": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", - "version": 6, - "date": "2021-09-16", - "author": "Patrick Bareiss, Splunk", - "type": "TTP", - "datamodel": [ - "Endpoint" - ], - "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", - "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", - "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", - "known_false_positives": "None identified.", - "references": [ - "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets" - ], - "tags": { - "name": "Attempted Credential Dump From Registry via Reg exe", - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" - ], - "asset_type": "Endpoint", - "automated_detection_testing": "passed", - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "confidence": 100, - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "dataset": [ - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log" - ], - "impact": 90, - "kill_chain_phases": [ - "Actions on Objectives" - ], - "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", - "mitre_attack_id": [ - "T1003.002", - "T1003" - ], - "nist": [ - "DE.CM" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "product": [ - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Cloud" - ], - "required_fields": [ - "_time", - "Processes.dest", - "Processes.user", - "Processes.parent_process_name", - "Processes.parent_process", - "Processes.original_file_name", - "Processes.process_name", - "Processes.process", - "Processes.process_id", - "Processes.parent_process_path", - "Processes.process_path", - "Processes.parent_process_id" - ], - "risk_score": 90, - "security_domain": "endpoint", - "risk_severity": "high", - "mitre_attack_techniques": [ - "Security Account Manager", - "OS Credential Dumping" - ], - "mitre_attack_tactics": [ - "Credential Access" - ], - "mitre_attack_groups": [ - "Wizard Spider", - "Threat Group-3390", - "Ke3chang", - "GALLIUM", - "Night Dragon", - "Dragonfly 2.0", - "menuPass", - "Tonto Team", - "APT39", - "Frankenstein", - "APT32", - "APT28", - "Leviathan", - "Sowbug", - "Suckfly", - "Poseidon Group", - "Axiom" - ] - }, - "deprecated": false, - "experimental": false, - "deployment": { - "name": "ESCU Default Configuration TTP", - "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", - "date": "2021-12-21", - "author": "Patrick Bareiss", - "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m", - "schedule_window": "auto" - }, - "notable": { - "rule_description": "%description%", - "rule_title": "%name%", - "nes_fields": [ - "user", - "dest" - ] - }, - "rba": { - "enabled": "true" - }, - "tags": { - "type": "TTP" - } - }, - "annotations": { - "mitre_attack": [ - "T1003.002", - "T1003" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ], - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "nist": [ - "DE.CM" - ], - "analytic_story": [ - "Credential Dumping", - "DarkSide Ransomware" - ], - "observable": [ - { - "name": "user", - "type": "User", - "role": [ - "Victim" - ] - }, - { - "name": "dest", - "type": "Hostname", - "role": [ - "Victim" - ] - }, - { - "name": "parent_process_name", - "type": "Process", - "role": [ - "Parent Process" - ] - }, - { - "name": "process_name", - "type": "Process", - "role": [ - "Child Process" - ] - } - ], - "context": [ - "Source:Endpoint", - "Stage:Credential Access" - ], - "impact": 90, - "confidence": 100 - }, - "risk": [ - { - "risk_object_type": "user", - "risk_object_field": "user", - "risk_score": 90 - }, - { - "risk_object_type": "system", - "risk_object_field": "dest", - "risk_score": 90 - }, - { - "threat_object_field": "parent_process_name", - "threat_object_type": "process" - }, - { - "threat_object_field": "process_name", - "threat_object_type": "process" - } - ], - "playbooks": [ - { - "name": "Ransomware Investigate and Contain", - "id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63", - "version": 1, - "date": "2018-02-04", - "author": "Philip Royer, Splunk", - "type": "Response", - "description": "This playbook investigates and contains ransomware detected on endpoints.", - "how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.", - "playbook": "ransomware_investigate_and_contain", - "references": [], - "app_list": [ - "Carbon Black Response", - "LDAP", - "Palo Alto Networks Firewall", - "WildFire", - "Cylance" - ], - "tags": { - "analytic_story": [ - "Ransomware" - ], - "detections": [ - "Conti Common Exec parameter", - "Attempted Credential Dump From Registry via Reg exe" - ], - "platform_tags": [ - "Ransomware", - "Response" - ], - "playbook_fields": [ - "ComputerName", - "Username" - ], - "product": [ - "Splunk SOAR" - ] - } - } - ], - "baselines": [], - "mappings": { - "mitre_attack": [ - "T1003.002", - "T1003" - ], - "kill_chain_phases": [ - "Actions on Objectives" - ], - "cis20": [ - "CIS 3", - "CIS 5", - "CIS 16" - ], - "nist": [ - "DE.CM" - ] - }, - "test": { - "name": "Attempted Credential Dump From Registry via Reg exe Unit Test", - "tests": [ - { - "name": "Attempted Credential Dump From Registry via Reg exe", - "file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml", - "pass_condition": "| stats count | where count > 0", - "earliest_time": "-24h", - "latest_time": "now", - "attack_data": [ - { - "file_name": "windows-sysmon.log", - "data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log", - "source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", - "sourcetype": "xmlwineventlog" - } - ] - } - ] - }, - "macros": [ - { - "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", - "definition": "search *", - "description": "Update this macro to limit the output results to filter out false positives." - } - ] - } - ], - "investigations": [ - { - "name": "Get Parent Process Info", - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "version": 2, - "date": "2019-02-28", - "author": "Bhavin Patel, Splunk", - "type": "Investigation", - "datamodel": [ - "Endpoint" - ], - "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", - "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", - "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "known_false_positives": "", - "references": [], - "tags": { - "analytic_story": [ - "Collection and Staging", - "Command and Control", - "DHS Report TA18-074A", - "Disabling Security Tools", - "Emotet Malware DHS Report TA18-201A ", - "Hidden Cobra Malware", - "Lateral Movement", - "Malicious PowerShell", - "Monitor for Unauthorized Software", - "Netsh Abuse", - "Orangeworm Attack Group", - "Phishing Payloads", - "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", - "Prohibited Traffic Allowed or Protocol Mismatch", - "Ransomware", - "SamSam Ransomware", - "Suspicious Command-Line Executions", - "Suspicious DNS Traffic", - "Suspicious MSHTA Activity", - "Suspicious WMI Use", - "Suspicious Windows Registry Activities", - "Unusual Processes", - "Windows Defense Evasion Tactics", - "Windows File Extension and Association Abuse", - "Windows Log Manipulation", - "Windows Persistence Techniques", - "Windows Privilege Escalation", - "Windows Service Abuse", - "DarkSide Ransomware" - ], - "product": [ - "Splunk Phantom" - ], - "required_fields": [ - "_time", - "Processes.user", - "Processes.parent_process_name", - "Processes.process_name", - "Processes.dest" - ], - "security_domain": "endpoint" - }, - "inputs": [ - "parent_process_name", - "dest" - ], - "lowercase_name": "get_parent_process_info" - } - ] - } -] \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml index 11b77cf7af..8efcde89fb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml @@ -28,12 +28,14 @@ detections: url: /detections/endpoint/ - title: "Product" children: + - title: "Splunk Enterprise" + url: /tags/#splunk-enterprise + - title: "Splunk Cloud" + url: /tags/#splunk-cloud - title: "Splunk Enterprise Security" url: /tags/#splunk-enterprise-security - title: "Splunk Behavioral Analytics" url: /tags/#splunk-behavioral-analytics - - title: "Splunk Security Analytics for AWS" - url: /tags/#splunk-security-analytics-for-aws stories: - title: "Use Case" children: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml index 11b77cf7af..8efcde89fb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml @@ -28,12 +28,14 @@ detections: url: /detections/endpoint/ - title: "Product" children: + - title: "Splunk Enterprise" + url: /tags/#splunk-enterprise + - title: "Splunk Cloud" + url: /tags/#splunk-cloud - title: "Splunk Enterprise Security" url: /tags/#splunk-enterprise-security - title: "Splunk Behavioral Analytics" url: /tags/#splunk-behavioral-analytics - - title: "Splunk Security Analytics for AWS" - url: /tags/#splunk-security-analytics-for-aws stories: - title: "Use Case" children: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py index 81aecc6bff..83613e82de 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py @@ -124,8 +124,8 @@ def test_write_investigations(): adapter = ObjToJsonAdapter() adapter.writeObjects([investigation], output_path, SecurityContentType.investigations) - path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_task.json') - path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_task_ref.json') + path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_tasks.json') + path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_tasks_ref.json') assert filecmp.cmp(path, path_ref, shallow=False) @@ -177,6 +177,6 @@ def test_write_stories(): adapter = ObjToJsonAdapter() adapter.writeObjects([story], output_path, SecurityContentType.stories) - path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/story.json') - path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/story_ref.json') + path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/stories.json') + path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/stories_ref.json') assert filecmp.cmp(path, path_ref, shallow=False) \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py index 9ab2a57cc4..7b014e4002 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py @@ -163,17 +163,9 @@ def test_attack_enrichment(): security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup()) detection = security_content_builder.getObject() - assert detection.tags.mitre_attack_enrichments[0].dict() == { - 'mitre_attack_id': 'T1003.002', - 'mitre_attack_technique': 'Security Account Manager', - 'mitre_attack_tactics': ['Credential Access'], - 'mitre_attack_groups': ['Dragonfly 2.0', 'GALLIUM', 'Ke3chang', 'Night Dragon', 'Threat Group-3390', 'Wizard Spider', 'menuPass'] - } - assert detection.tags.mitre_attack_enrichments[1].dict() == { - 'mitre_attack_id': 'T1003', - 'mitre_attack_technique': 'OS Credential Dumping', - 'mitre_attack_tactics': ['Credential Access'], 'mitre_attack_groups': ['APT28', 'APT32', 'APT39', 'Axiom', 'Frankenstein', 'Leviathan', 'Poseidon Group', 'Sowbug', 'Suckfly', 'Tonto Team'] - } + assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_id'] == 'T1003.002' + assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_technique'] == 'Security Account Manager' + assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_tactics'] == ['Credential Access'] def test_macros_enrichment(): diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py index a1881937d9..589d7f3e28 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py @@ -35,17 +35,6 @@ def test_add_detections(): assert story.detection_names == ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"] assert story.tags.datamodels == ['Endpoint'] assert story.tags.kill_chain_phases == ['Actions on Objectives'] - assert story.tags.mitre_attack_enrichments[0].dict() == { - 'mitre_attack_id': 'T1003.002', - 'mitre_attack_technique': 'Security Account Manager', - 'mitre_attack_tactics': ['Credential Access'], - 'mitre_attack_groups': ['Dragonfly 2.0', 'GALLIUM', 'Ke3chang', 'Night Dragon', 'Threat Group-3390', 'Wizard Spider', 'menuPass'] - } - assert story.tags.mitre_attack_enrichments[1].dict() == { - 'mitre_attack_id': 'T1003', - 'mitre_attack_technique': 'OS Credential Dumping', - 'mitre_attack_tactics': ['Credential Access'], 'mitre_attack_groups': ['APT28', 'APT32', 'APT39', 'Axiom', 'Frankenstein', 'Leviathan', 'Poseidon Group', 'Sowbug', 'Suckfly', 'Tonto Team'] - } def test_add_baselines(): diff --git a/lookups/mitre_enrichment.csv b/lookups/mitre_enrichment.csv index 0717cbc6ba..d2c021c4e4 100644 --- a/lookups/mitre_enrichment.csv +++ b/lookups/mitre_enrichment.csv @@ -438,3 +438,19 @@ T1006,Direct Volume Access,Defense Evasion,no T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom T1001,Data Obfuscation,Command And Control,Axiom +T1204.003,Malicious Image,Execution,no +T1580,Cloud Infrastructure Discovery,Discovery,no +T1547.014,Active Setup,Persistence|Privilege Escalation,no +T1595,Active Scanning,Reconnaissance,no +T1558.004,AS-REP Roasting,Credential Access,no +T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no +T1016.001,Internet Connection Discovery,Discovery,no +T1547.012,Print Processors,Persistence|Privilege Escalation,no +T1592,Gather Victim Host Information,Reconnaissance,no +T1218.012,Verclsid,Defense Evasion,no +T1590,Gather Victim Network Information,Reconnaissance,no +T1590.005,IP Addresses,Reconnaissance,no +T1588.002,Tool,Resource Development,no +T1557.002,ARP Cache Poisoning,Credential Access|Collection,no +T1542.005,TFTP Boot,Defense Evasion|Persistence,no +T1020.001,Traffic Duplication,Exfiltration,no \ No newline at end of file