From 3029c919150dd9c4be414a16506b8bf5dff8a00f Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 1 Feb 2022 14:02:30 -0500 Subject: [PATCH 1/3] fixes TR-1309 --- bin/generate.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bin/generate.py b/bin/generate.py index bc5d1f9588..9adc60c58b 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -428,13 +428,17 @@ def add_rba(detection): risk_object['risk_object_type'] = 'system' risk_object['risk_object_field'] = entity['name'] - risk_object['risk_score'] = detection['tags']['risk_score'] + if (detection['tags']['risk_score']): + risk_object['risk_score'] = detection['tags']['risk_score'] + else: + risk_object['risk_score'] = 0 risk_objects.append(risk_object) # if is not a system or user, it is a threat object else: risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() + risk_object['risk_score'] = 0 risk_objects.append(risk_object) continue From 6e2f53317f09dd4a036fa99350309d3d68b91ac5 Mon Sep 17 00:00:00 2001 From: research bot Date: Wed, 2 Feb 2022 18:49:33 +0000 Subject: [PATCH 2/3] updating docs and package bits [ci skip] --- dist/escu/default/analyticstories.conf | 4 ++-- dist/escu/default/app.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 2 +- dist/escu/default/transforms.conf | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index ed4c8cdbf8..65b5a4d055 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -625,7 +625,7 @@ references = ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injectio maintainers = [{"company": "no", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"] -description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' +description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Splunk Investigation', 'Log4j Investigate', 'Log4j Respond' narrative = In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called ["A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system. [analytic_story://Malicious PowerShell] diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index b257498dce..88d42531c5 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 4848 +build = 4868 [triggers] reload.analytic_stories = simple diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index e0038d4056..f2922d4abb 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 3760d30279..ba0d1ab194 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -337,7 +337,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_log4shell_cve_2021_44228] label = Log4Shell CVE-2021-44228 -description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' +description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Splunk Investigation', 'Log4j Investigate', 'Log4j Respond' disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task"] diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 7a4bc6a975..4770aee3f3 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 6769f2872d..2f8d2bb9c8 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 776e07cdfa..ee04138b48 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# From 23fef2c5fc049780be5621364879cc8dfa31a0bf Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Feb 2022 12:17:46 -0800 Subject: [PATCH 3/3] jinja change --- bin/generate.py | 6 +----- bin/jinja2_templates/savedsearches.j2 | 1 + 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 9adc60c58b..bc5d1f9588 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -428,17 +428,13 @@ def add_rba(detection): risk_object['risk_object_type'] = 'system' risk_object['risk_object_field'] = entity['name'] - if (detection['tags']['risk_score']): - risk_object['risk_score'] = detection['tags']['risk_score'] - else: - risk_object['risk_score'] = 0 + risk_object['risk_score'] = detection['tags']['risk_score'] risk_objects.append(risk_object) # if is not a system or user, it is a threat object else: risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() - risk_object['risk_score'] = 0 risk_objects.append(risk_object) continue diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 77359896c7..38aecc2169 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -49,6 +49,7 @@ action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} action.risk = 1 action.risk.param._risk_message = {{ detection.risk_message }} action.risk.param._risk = {{ detection.risk | tojson }} +action.risk.param._risk_score = 0 action.risk.param.verbose = 0 {% endif %} {% else %}