Merge branch 'develop' into TR162

automated_detection_testing/requirements.txt

@@ -4,10 +4,10 @@ apipkg==1.5
 aspy.yaml==1.3.0
 atomicwrites==1.4.0
 attackcti==0.3.3
-attrs==19.3.0
+attrs==20.3.0
 bcrypt==3.2.0
-boto3==1.16.10
-botocore==1.19.10
+botocore==1.19.11
+boto3==1.16.11
 certifi==2019.11.28
 cffi==1.14.3
 cfgv==2.0.1

bin/validate_ssa.py

@@ -8,9 +8,11 @@ import argparse
 import sys
 import coloredlogs
 import logging
+import json
 
 SSML_CWD = ".humvee"
-HUMVEE_URL = "https://repo.splunk.com/artifactory/maven-splunk-local/com/splunk/humvee-scala_2.11/1.2.1-SNAPSHOT/humvee-scala_2.11-1.2.1-20201022.220521-1.jar"
+HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local"
+
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.INFO)
@@ -81,12 +83,23 @@ def extract_pipeline(search, data, pass_condition):
     return updated_search
 
 
+def get_latest_humvee_object():
+    res = json.loads(urllib.request.urlopen(HUMVEE_ARTIFACT_SEARCH).read().decode('utf-8'))
+    for r in res['results']:
+        if re.match(r".*/latest/humvee-.*\.jar$", r['uri']):
+            latest_humvee = json.loads(urllib.request.urlopen(r['uri']).read().decode('utf-8'))
+            return latest_humvee
+    return ""
+
+
 def build_humvee():
     if not os.path.exists(get_path(SSML_CWD)):
         os.mkdir(get_path(SSML_CWD))
-    if not os.path.exists(get_path("%s/humvee.jar" % SSML_CWD)):
-        logger.debug("Downloading Humvee")
-        urllib.request.urlretrieve(HUMVEE_URL, "%s/humvee.jar" % get_path(SSML_CWD))
+    latest_humvee_object = get_latest_humvee_object()
+    log(logging.INFO, "Downloading Latest Humvee")
+    log(logging.DEBUG, "Humvee details", detail=latest_humvee_object)
+    urllib.request.urlretrieve(latest_humvee_object['downloadUri'], "%s/humvee.jar" % get_path(SSML_CWD))
+
 
 
 def activate_detection(detection, data, pass_condition):

detections/endpoint/first_time_seen_cmd_line___ssa.yml

@@ -16,6 +16,7 @@ search: '| from read_ssa_enriched_events()
        cmd_line=lower(ucast(map_get(input_event, "process"), "string", null))
 | where process_name="cmd.exe" AND
         match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true
+| select cmd_line, timestamp, dest_device_id, dest_user_id
 | first_time_event cache_partitions=5 input_columns="cmd_line"
 | where first_time_cmd_line
 | eval start_time = timestamp,

requirements.txt

@@ -2,7 +2,7 @@ antlr4-python3-runtime==4.8
 appdirs==1.4.4
 aspy.yaml==1.3.0
 attackcti==0.3.3
-attrs==20.2.0
+attrs==20.3.0
 certifi==2020.6.20
 cfgv==3.2.0
 chardet==3.0.4