From 1ca0ffa3ea8ccdb0ab65c3997fbd0493e86d5000 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 6 Jan 2022 13:45:29 -0800 Subject: [PATCH] Update datamodel=MODEL fields to datamodel=Model.Submodel --- .../investigate_failed_logins_for_multiple_destinations.yml | 2 +- detections/endpoint/investigate_previous_unseen_user.yml | 2 +- .../investigate_successful_remote_desktop_authentications.yml | 2 +- .../endpoint/java_class_file_download_by_java_user_agent.yml | 2 +- detections/endpoint/short_lived_windows_accounts.yml | 2 +- detections/endpoint/windows_updates_install_failures.yml | 2 +- detections/endpoint/windows_updates_install_successes.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml index e236f84925..0a0d6fb878 100644 --- a/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml +++ b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml @@ -9,7 +9,7 @@ datamodel: description: This search returns failed logins to multiple destinations by user. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) - AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication + AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication.Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search user=$user$' diff --git a/detections/endpoint/investigate_previous_unseen_user.yml b/detections/endpoint/investigate_previous_unseen_user.yml index cc6582b2e1..219aae1c4c 100644 --- a/detections/endpoint/investigate_previous_unseen_user.yml +++ b/detections/endpoint/investigate_previous_unseen_user.yml @@ -11,7 +11,7 @@ description: This search returns previous unseen user, which didn't log in for 3 search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from - datamodel=Authentication where Authentication.action=success by _time, Authentication.user + datamodel=Authentication.Authentication where Authentication.action=success by _time, Authentication.user | bucket _time span=30d | stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml index 0ef0b02006..05c5a9a59e 100644 --- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml +++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml @@ -10,7 +10,7 @@ description: 'This search returns the source, destination, and user for all succ remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. ' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Authentication where Authentication.signature_id=4624 + as lastTime from datamodel=Authentication.Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app Authentication.user Authentication.signature Authentication.src_nt_domain | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")` diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index 864c3d03fd..03c7bc0dbf 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -10,7 +10,7 @@ description: The following analytic identifies a Java user agent performing a GE request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). -search: '| tstats count from datamodel=Web where Web.http_user_agent="*Java*" Web.http_method="GET" +search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`' diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 41eaafaaab..839c7fb59b 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -9,7 +9,7 @@ datamodel: description: This search detects accounts that were created and deleted in a short time period. search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as - result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change + result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726 diff --git a/detections/endpoint/windows_updates_install_failures.yml b/detections/endpoint/windows_updates_install_failures.yml index 4397e27dac..6c77921de2 100644 --- a/detections/endpoint/windows_updates_install_failures.yml +++ b/detections/endpoint/windows_updates_install_failures.yml @@ -9,7 +9,7 @@ description: This search is intended to give you a feel for how often Windows up fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM - datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure + datamodel=Updates.Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d' how_to_implement: You must be ingesting your Windows Update Logs known_false_positives: none diff --git a/detections/endpoint/windows_updates_install_successes.yml b/detections/endpoint/windows_updates_install_successes.yml index 0cb6e5ea18..6c52867266 100644 --- a/detections/endpoint/windows_updates_install_successes.yml +++ b/detections/endpoint/windows_updates_install_successes.yml @@ -9,7 +9,7 @@ description: This search is intended to give you a feel for how often successful updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM - datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed + datamodel=Updates.Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d' how_to_implement: You must be ingesting your Windows Update Logs known_false_positives: none