From 7234237741dba59870b585309e6f7c562f5a8724 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2020 14:03:55 +0000 Subject: [PATCH 1/5] Bump botocore from 1.19.10 to 1.19.11 Bumps [botocore](https://github.com/boto/botocore) from 1.19.10 to 1.19.11. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.19.10...1.19.11) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 418ec03831..c41352979f 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -7,7 +7,7 @@ attackcti==0.3.3 attrs==19.3.0 bcrypt==3.2.0 boto3==1.16.10 -botocore==1.19.10 +botocore==1.19.11 certifi==2019.11.28 cffi==1.14.3 cfgv==2.0.1 From cbc0fd5aa34d1fc0532659fdce02fc23a07f6a88 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2020 14:03:57 +0000 Subject: [PATCH 2/5] Bump boto3 from 1.16.10 to 1.16.11 Bumps [boto3](https://github.com/boto/boto3) from 1.16.10 to 1.16.11. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.16.10...1.16.11) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 418ec03831..2b93660fc4 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -6,7 +6,7 @@ atomicwrites==1.4.0 attackcti==0.3.3 attrs==19.3.0 bcrypt==3.2.0 -boto3==1.16.10 +boto3==1.16.11 botocore==1.19.10 certifi==2019.11.28 cffi==1.14.3 From 17c2951b924932e887371c1fb242b69db4c5e0c7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2020 14:03:58 +0000 Subject: [PATCH 3/5] Bump attrs from 20.2.0 to 20.3.0 Bumps [attrs](https://github.com/python-attrs/attrs) from 20.2.0 to 20.3.0. - [Release notes](https://github.com/python-attrs/attrs/releases) - [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst) - [Commits](https://github.com/python-attrs/attrs/compare/20.2.0...20.3.0) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 418ec03831..47b31f6205 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -4,7 +4,7 @@ apipkg==1.5 aspy.yaml==1.3.0 atomicwrites==1.4.0 attackcti==0.3.3 -attrs==19.3.0 +attrs==20.3.0 bcrypt==3.2.0 boto3==1.16.10 botocore==1.19.10 diff --git a/requirements.txt b/requirements.txt index 95eb0f4033..5f7d773cca 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,7 +2,7 @@ antlr4-python3-runtime==4.8 appdirs==1.4.4 aspy.yaml==1.3.0 attackcti==0.3.3 -attrs==20.2.0 +attrs==20.3.0 certifi==2020.6.20 cfgv==3.2.0 chardet==3.0.4 From c57016f99d0ef71313c59f375a3d462b3c61f042 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Thu, 5 Nov 2020 11:46:46 -0800 Subject: [PATCH 4/5] using artifactory api to retrieve latest humvee jar --- bin/validate_ssa.py | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/bin/validate_ssa.py b/bin/validate_ssa.py index b99a600fce..4709b1d4f2 100644 --- a/bin/validate_ssa.py +++ b/bin/validate_ssa.py @@ -8,9 +8,11 @@ import argparse import sys import coloredlogs import logging +import json SSML_CWD = ".humvee" -HUMVEE_URL = "https://repo.splunk.com/artifactory/maven-splunk-local/com/splunk/humvee-scala_2.11/1.2.1-SNAPSHOT/humvee-scala_2.11-1.2.1-20201022.220521-1.jar" +HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local" + logger = logging.getLogger(__name__) logger.setLevel(logging.INFO) @@ -81,12 +83,23 @@ def extract_pipeline(search, data, pass_condition): return updated_search +def get_latest_humvee_object(): + res = json.loads(urllib.request.urlopen(HUMVEE_ARTIFACT_SEARCH).read().decode('utf-8')) + for r in res['results']: + if re.match(r".*/latest/humvee-.*\.jar$", r['uri']): + latest_humvee = json.loads(urllib.request.urlopen(r['uri']).read().decode('utf-8')) + return latest_humvee + return "" + + def build_humvee(): if not os.path.exists(get_path(SSML_CWD)): os.mkdir(get_path(SSML_CWD)) - if not os.path.exists(get_path("%s/humvee.jar" % SSML_CWD)): - logger.debug("Downloading Humvee") - urllib.request.urlretrieve(HUMVEE_URL, "%s/humvee.jar" % get_path(SSML_CWD)) + latest_humvee_object = get_latest_humvee_object() + log(logging.INFO, "Downloading Latest Humvee") + log(logging.DEBUG, "Humvee details", detail=latest_humvee_object) + urllib.request.urlretrieve(latest_humvee_object['downloadUri'], "%s/humvee.jar" % get_path(SSML_CWD)) + def activate_detection(detection, data, pass_condition): From 10917d4c8dffd939e9f021a562f7442a56da3fb6 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Thu, 5 Nov 2020 19:19:50 -0800 Subject: [PATCH 5/5] Selecting only necessary fields to avoid serialization problem on DSP --- detections/endpoint/first_time_seen_cmd_line___ssa.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/first_time_seen_cmd_line___ssa.yml b/detections/endpoint/first_time_seen_cmd_line___ssa.yml index cea30c3771..10ecfad9e4 100644 --- a/detections/endpoint/first_time_seen_cmd_line___ssa.yml +++ b/detections/endpoint/first_time_seen_cmd_line___ssa.yml @@ -16,6 +16,7 @@ search: '| from read_ssa_enriched_events() cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)) | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true +| select cmd_line, timestamp, dest_device_id, dest_user_id | first_time_event cache_partitions=5 input_columns="cmd_line" | where first_time_cmd_line | eval start_time = timestamp,