diff --git a/.gitignore b/.gitignore index 26dc097f54..0e3d724591 100644 --- a/.gitignore +++ b/.gitignore @@ -4,6 +4,9 @@ detections/*/.yml.example stories/*.yml.example tests/*/*.yml.example +# IDE +.vscode/ + # usual mac files .DS_Store #vim files diff --git a/bin/generate.py b/bin/generate.py index 3c2763e8e1..a4eecd7da6 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -124,11 +124,17 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_score'] = detection['tags']['risk_score'] if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] + if (OUTPUT_PATH) == 'dist/mustang': + detection['disabled'] = 'false' + + for baseline in baselines: data_model = parse_data_models_from_search(baseline['search']) if data_model: baseline['data_model'] = data_model + if (OUTPUT_PATH) == 'dist/mustang': + baseline['disabled'] = 'false' matched_deployment = get_deployments(baseline, deployments) baseline['deployment'] = matched_deployment diff --git a/bin/jinja2_templates/analytic_stories.j2 b/bin/jinja2_templates/analytic_stories.j2 index eac6ee050f..ba45f92e02 100644 --- a/bin/jinja2_templates/analytic_stories.j2 +++ b/bin/jinja2_templates/analytic_stories.j2 @@ -39,6 +39,7 @@ description = {{ story.description }} {% if story.narrative is defined %} narrative = {{ story.narrative }} {% endif %} +product = {{ story.tags.product}} {% endfor %} #### END STORIES #### diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 351c73851d..55bfce0eb6 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -82,7 +82,11 @@ action.email.useNSSubject = 1 {% endif %} {% endif %} alert.digest_mode = 1 +{% if detection.disabled is defined %} +disabled = false +{% else %} disabled = true +{% endif %} enableSched = 1 counttype = number of events relation = greater than @@ -134,7 +138,11 @@ action.escu.how_to_implement = {{ baseline.how_to_implement }} {% else %} action.escu.how_to_implement = none {% endif %} +{% if baseline.disabled is defined %} +disabled = false +{% else %} disabled = true +{% endif %} is_visible = false search = {{ baseline.search }} diff --git a/bin/ssa-end-to-end-testing/requirements.txt b/bin/ssa-end-to-end-testing/requirements.txt index 0a8d577caa..df929bb9d2 100644 --- a/bin/ssa-end-to-end-testing/requirements.txt +++ b/bin/ssa-end-to-end-testing/requirements.txt @@ -20,4 +20,4 @@ six==1.15.0 smmap==3.0.5 toml==0.10.2 u-msgpack-python==2.7.1 -urllib3==1.26.3 +urllib3==1.26.4 diff --git a/bin/validate.py b/bin/validate.py index aebb7fe608..d0da8ab741 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -47,10 +47,10 @@ def validate_schema(REPO_PATH, type, objects, verbose): print("Error reading {0}".format(manifest_file)) error = True continue - try: - jsonschema.validate(instance=object, schema=schema) - except jsonschema.exceptions.ValidationError as json_ve: - errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file)) + + validator = jsonschema.Draft7Validator(schema, format_checker=jsonschema.FormatChecker()) + for schema_error in validator.iter_errors(object): + errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(schema_error.message), manifest_file)) error = True if type in objects: @@ -70,7 +70,7 @@ def validate_objects(REPO_PATH, objects, verbose): errors = [] for lookup in objects['lookups']: - lookup_errors = validate_lookups_content(REPO_PATH, "lookups/%s", lookup) + errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup) objects_array = objects['stories'] + objects['detections'] + objects['baselines'] + objects['response_tasks'] + objects['responses'] for object in objects_array: @@ -85,12 +85,9 @@ def validate_objects(REPO_PATH, objects, verbose): for object in objects['baselines']: errors = errors + validate_baseline_search(object, objects['macros']) - for object in objects['tests']: errors = errors + validate_tests(REPO_PATH, object) - errors = lookup_errors + errors - return errors diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 55cbd2377c..afe2f0cf0b 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Malicious PowerShell + - Ingress Tool Transfer dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 9b335941a7..018246a866 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Malicious PowerShell - HAFNIUM Group + - Ingress Tool Transfer automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml new file mode 100644 index 0000000000..f0444e99c5 --- /dev/null +++ b/detections/endpoint/bits_job_persistence.yml @@ -0,0 +1,53 @@ +name: BITS Job Persistence +id: e97a5ffe-90bf-11eb-928a-acde48001122 +version: 1 +date: '2021-03-29' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. + The query identifies the parameters used to create, resume or add a file to a BITS + job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` + to list out the jobs during investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe + Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, + *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives will be present. Typically, applications + will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments + (legitimate applications) or parent process. +references: +- https://attack.mitre.org/techniques/T1197/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute +- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ +tags: + analytic_story: + - BITS Jobs + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1197 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.dest + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml new file mode 100644 index 0000000000..a7fa7ba5c3 --- /dev/null +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -0,0 +1,60 @@ +name: BITSAdmin Download File +id: 80630ff4-8e4c-11eb-aab5-acde48001122 +version: 1 +date: '2021-03-26' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote + object. In addition, look for `download` or `upload` on the command-line, the switches + are not required to perform a transfer. Capture any files downloaded. Review the + reputation of the IP or domain used. Typically once executed, a follow on command + will be used to execute the dropped file. Note that the network connection or file + modification events related will not spawn or create from `bitsadmin.exe`, but the + artifacts will appear in a parallel process of `svchost.exe` with a command-line + similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel + and child processes to capture any behaviors and artifacts. In some suspicious and + malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` + to list out the jobs during investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe + Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `bitsadmin_download_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives, however it may be required to filter + based on parent process name or network connection. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download +- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md +- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +tags: + analytic_story: + - Ingress Tool Transfer + - BITS Jobs + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1197 + - T1105 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.dest + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml new file mode 100644 index 0000000000..3f31a7ffa2 --- /dev/null +++ b/detections/endpoint/disable_registry_tool.yml @@ -0,0 +1,49 @@ +name: Disable Registry Tool +id: cd2cf33c-9201-11eb-a10a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies modification of registry to disable the + regedit or registry tools of windows operating system. Since registry tool is a + swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this + application to prevent the removal of their registry entry such as persistence, + file less components and defense evasion. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml new file mode 100644 index 0000000000..036ea045f8 --- /dev/null +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -0,0 +1,52 @@ +name: Disable Show Hidden Files +id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search is to idetifies a modification in registry to prevent + the user seeing all the files with hidden attributes. This event or techniques are + known on some worm and trojan spy malware that will drop hidden files on the infected + machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" + OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" + Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= + "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" + Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1564.001 + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_nam + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml new file mode 100644 index 0000000000..7c5ab7d25e --- /dev/null +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -0,0 +1,51 @@ +name: Disable Windows Behavior Monitoring +id: 79439cae-9200-11eb-a4d3-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies a modification in registry to disable the + windows denfender real time behavior monitoring. This event or technique is commonly + seen in RAT, bot, or Trojan to disable AV to evade detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows + Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= + "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" + OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time + Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml new file mode 100644 index 0000000000..b127627da0 --- /dev/null +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -0,0 +1,49 @@ +name: Disable Windows SmartScreen Protection +id: 664f0fd0-91ff-11eb-a56f-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies a modification of registry to disable + the smartscreen protection of windows machine. This is windows feature provide an + early warning system against website that might engage in phishing attack or malware + distribution. This modification are seen in RAT malware to cover their tracks upon + downloading other of its component or other payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name + = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_nam + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml new file mode 100644 index 0000000000..60d544c9bb --- /dev/null +++ b/detections/endpoint/disabling_cmd_application.yml @@ -0,0 +1,48 @@ +name: Disabling CMD Application +id: ff86077c-9212-11eb-a1e6-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable cmd prompt + application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging + or deleting there samples through cmd application which is one of the tool of analyst + to traverse on directory and files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml new file mode 100644 index 0000000000..f4c03a35b8 --- /dev/null +++ b/detections/endpoint/disabling_controlpanel.yml @@ -0,0 +1,47 @@ +name: Disabling ControlPanel +id: 6ae0148e-9215-11eb-a94a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify registry modification to disable control panel + window. This technique is commonly seen in malware to prevent their artifacts , + persistence removed on the infected machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml new file mode 100644 index 0000000000..03fff72233 --- /dev/null +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -0,0 +1,52 @@ +name: Disabling Firewall with Netsh +id: 6860a62c-9203-11eb-9e05-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies suspicious firewall disabling using netsh + application. this technique is commonly seen in malware that tries to communicate + or download its component or other payload to its C2 server. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= + "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint file-system data model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: admin may disable firewall during testing or fixing network + problem. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml new file mode 100644 index 0000000000..59adce28fc --- /dev/null +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -0,0 +1,49 @@ +name: Disabling FolderOptions Windows Feature +id: 83776de4-921a-11eb-868a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identify registry modification to disable folder options + feature of windows to show hidden files, file extension and etc. This technique + used by malware in combination if disabling show hidden files feature to hide their + files and also to hide the file extension to lure the user base on file icons or + fake file extensions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml new file mode 100644 index 0000000000..e77ffbd10c --- /dev/null +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -0,0 +1,50 @@ +name: Disabling NoRun Windows App +id: de81bc46-9213-11eb-adc9-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identify modification of registry to disable run application + in window start menu. this application is known to be a helpful shortcut to windows + OS user to run known application and also to execute some reg or batch script. This + technique is used malware to make cleaning of its infection more harder by preventing + known application run easily through run shortcut. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.malwarebytes.com/detections/pum-optional-norun/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml new file mode 100644 index 0000000000..f0ed94188f --- /dev/null +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -0,0 +1,50 @@ +name: Disabling SystemRestore In Registry +id: f4f837e2-91fb-11eb-8bf6-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies the modification of registry related + in disabling the system restore of a machine. This event or behavior are seen in + some RAT malware to make the restore of the infected machine difficult and keep + their infection on the box. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = + "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: in some cases admin can disable systemrestore on a machine. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml new file mode 100644 index 0000000000..f1ce08549d --- /dev/null +++ b/detections/endpoint/disabling_task_manager.yml @@ -0,0 +1,49 @@ +name: Disabling Task Manager +id: dac279bc-9202-11eb-b7fb-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies modification of registry to disable the + task manager of windows operating system. this event or technique are commonly seen + in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate + their process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml new file mode 100644 index 0000000000..8e3d815a65 --- /dev/null +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -0,0 +1,66 @@ +name: DSQuery Domain Discovery +id: cc316032-924a-11eb-91a2-acde48001122 +version: 1 +date: '2021-03-31' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: 'The following analytic identifies "dsquery.exe" execution with arguments + looking for `TrustedDomain` query directly on the command-line. This is typically + indicative of an Administrator or adversary perform domain trust discovery. Note + that this query does not identify any other variations of "Dsquery.exe" usage.\ + + Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ + + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, process + "dsquery.exe" and its parent process.\ + + DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` + and only on Server operating system.\ + + The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found + loaded by another process, it is possible dsquery is running within that process + context in memory.\ + + In addition to trust discovery, review parallel processes for additional behaviors + performed. Identify the parent process and capture any files (batch files, for example) + being used.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe + Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `dsquery_domain_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives. If there is a true false positive, + filter based on command-line or parent process. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md +- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) +tags: + analytic_story: + - Domain Trust Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1482 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.user + - Processes.dest + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index e6e45673e1..e63be64c0a 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Ryuk Ransomware + - Domain Trust Discovery asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml new file mode 100644 index 0000000000..01fa11718a --- /dev/null +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -0,0 +1,52 @@ +name: PowerShell Start-BitsTransfer +id: 39e2605a-90d8-11eb-899e-acde48001122 +version: 1 +date: '2021-03-29' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar + functionality is present. This technique variation is not as commonly used by adversaries, + but has been abused in the past. Lesser known uses include the ability to set the + `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` + is used, it is highly possible files will be archived. During triage, review parallel + processes and process lineage. Capture any files on disk and review. For the remote + domain or IP, what is the reputation? +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe + Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_start_bitstransfer_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives. It is possible administrators will + utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent + process or command-line arguments. +references: +- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 +- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs +tags: + analytic_story: + - BITS Jobs + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1197 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process + - Processes.process_name + - Processes.user + - Processes.dest + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/experimental/endpoint/windows_adfind_exe.yml b/detections/experimental/endpoint/windows_adfind_exe.yml index c02fe85f37..cd184c74e6 100644 --- a/detections/experimental/endpoint/windows_adfind_exe.yml +++ b/detections/experimental/endpoint/windows_adfind_exe.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - NOBELIUM Group + - Domain Trust Discovery asset_type: Endpoint cis20: - CIS 8 diff --git a/dist/escu/appserver/static/alert_escu_contextualize.png b/dist/escu/appserver/static/alert_escu_contextualize.png new file mode 100644 index 0000000000..23c161b5c2 Binary files /dev/null and b/dist/escu/appserver/static/alert_escu_contextualize.png differ diff --git a/dist/escu/appserver/static/alert_escu_investigate.png b/dist/escu/appserver/static/alert_escu_investigate.png new file mode 100644 index 0000000000..23c161b5c2 Binary files /dev/null and b/dist/escu/appserver/static/alert_escu_investigate.png differ diff --git a/dist/escu/appserver/static/alerticon.png b/dist/escu/appserver/static/alerticon.png new file mode 100644 index 0000000000..c7f9d26890 Binary files /dev/null and b/dist/escu/appserver/static/alerticon.png differ diff --git a/dist/escu/appserver/static/analytic_story_details.css b/dist/escu/appserver/static/analytic_story_details.css new file mode 100644 index 0000000000..ce54b7882b --- /dev/null +++ b/dist/escu/appserver/static/analytic_story_details.css @@ -0,0 +1,187 @@ +/* .rTable { + display: table; + width: 100%; +} + +.rTableRow { + display: table-row; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; +} + +.rTableCell, .rTableHead { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; +} + +.rTableLeftCell { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; + width: 200px; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; + font-weight: bold; +} + +.rTableFoot { + display: table-footer-group; + font-weight: bold; + background-color: #ddd; +} + +.rTableBody { + display: table-row-group; +} */ + +h1 { + font-size: 24px; + font-weight: 200; + margin: 0; +} + +h3 { + padding-left: 10px; +} + +.as_title_attr_bar { + padding-left: 15%; + background-color: #eee; + height: 40px; + line-height: 40px; + margin-bottom: 7px; +} + +.as_title_attr { + float: left; + margin-right: 5%; + padding-right: 20px; + font-size: 14px; +} + +.as_search_accordion { + width: 100%; + margin-top: 10px; +} + +.as_story_details { + display: flex; + max-height: 500px; + clear: both; +} + +.as_story_details_left_col { + float: right; + width: 34%; + display: block; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_story_details_right_col { + float: left; + width: 60%; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_left_attr{ + display: inline-block; + width: 100%; +} + +.as_story_detail_left_attr_label { + float: left; + width: 30%; + padding-top: 2%; +} + +.as_story_detail_left_attr { + margin-top: 5px; + float: left; + width: 70%; +} + +.value_label { + float: left; + margin-right: 5px; + background-color: #eee; + padding: 4px; + border-radius: 6px; + margin-bottom: 5px; +} + +.as_story_detail_right_attr_label { + margin-bottom: 7px; +} + +.search_content { + display: flex; + clear: both; +} + +.search_left_panel { + float: left; + width: 70%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_right_panel { + float: left; + width: 25%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_left_attr { + margin: 10px; +} + +.search_right_attr { + margin: 10px; + display: table; +} + +.search_string{ + padding: 10px; + background-color: #ddd; + border: 1px solid #aaa; + border-radius: 2px; +} + +.data_model_tag { + background-color: #11a88b; +} + +.kill_chain_tag { + background-color: #ed8440; + color: #303841; +} + +.attack_tag { + background-color: #3863a0; + color: #eee; +} + +.heading-story { + width: 80%; + float: left; +} + +.run_story_btn { + float: right; +} \ No newline at end of file diff --git a/dist/escu/appserver/static/analytic_story_details.js b/dist/escu/appserver/static/analytic_story_details.js new file mode 100644 index 0000000000..932b4426f0 --- /dev/null +++ b/dist/escu/appserver/static/analytic_story_details.js @@ -0,0 +1,575 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager', + 'splunkjs/mvc/searchbarview', + 'splunkjs/mvc/tableview', + 'splunk.util', + '../app/DA-ESS-ContentUpdate/js/lib/showdown.min', + '../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui', + 'css!../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui.css', + 'css!../app/DA-ESS-ContentUpdate/analytic_story_details.css', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, SearchManager, SearchBarView, TableView, splunkUtil, showdown) { + + let tokenModel = mvc.Components.get("default"); + let renderedComponents = []; + + let templ = ` +
+