fixed more detections

bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py

@@ -119,4 +119,16 @@ class ContentChanger:
                     if observable['type'] == 'Parent Process':
                         observable['type'] = 'Process'
                     if observable['type'] == 'user':
-                        observable['type'] = 'User'
+                        observable['type'] = 'User'
+                    if observable['type'] == 'process name':
+                        observable['type'] = 'Process'
+
+    def fix_context(self, objects : list) -> None:
+        for obj in objects:
+            if 'context' in obj['tags']:
+                new_context = []
+                for context in obj['tags']['context']:
+                    if ':' not in context:
+                        continue
+                    new_context.append(context)
+                obj['tags']['context'] = new_context

detections/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -51,7 +51,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml

@@ -30,13 +30,22 @@ tags:
   analytic_story:
   - Ransomware
   automated_detection_testing: passed
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
+  message: ''
   mitre_attack_id:
   - T1562.007
   - T1562
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -44,7 +44,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/detect_exchange_web_shell.yml

@@ -55,7 +55,7 @@ tags:
   confidence: 90
   context:
   - Source:Endpoint
-  - Stage:Exploitation
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
   impact: 90

detections/endpoint/disable_logs_using_wevtutil.yml

@@ -29,8 +29,8 @@ tags:
   automated_detection_testing: passed
   confidence: 80
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
   impact: 30

detections/endpoint/drop_icedid_license_dat.yml

@@ -43,7 +43,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/icedid_exfiltrated_archived_file_creation.yml

@@ -43,7 +43,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/office_application_drop_executable.yml

@@ -56,7 +56,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml

@@ -59,7 +59,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/permission_modification_using_takeown_app.yml

@@ -46,7 +46,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/powershell_disable_security_monitoring.yml

@@ -37,9 +37,15 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
+  message: ''
   mitre_attack_id:
   - T1562.001
   - T1562
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/powershell_remote_thread_to_known_windows_process.yml

@@ -47,7 +47,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/processes_launching_netsh.yml

@@ -38,8 +38,8 @@ tags:
   - CIS 8
   confidence: 70
   context:
-  - source:endpoint
-  - stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log
   impact: 60

detections/endpoint/rundll32_create_remote_thread_to_a_process.yml

@@ -44,7 +44,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/rundll32_createremotethread_in_browser.yml

@@ -45,7 +45,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/rundll32_dnsquery.yml

@@ -46,7 +46,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/rundll32_process_creating_exe_dll_files.yml

@@ -44,7 +44,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/ryuk_wake_on_lan_command.yml

@@ -35,8 +35,8 @@ tags:
   automated_detection_testing: passed
   confidence: 90
   context:
-  - source:endpoint
-  - stage: Execution
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log
   impact: 70

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -35,10 +35,8 @@ tags:
   - CIS 3
   confidence: 90
   context:
-  - source:endpoint
-  - stage: Execution
-  - Persistence
-  - Privilege Escalation
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log
   impact: 70

detections/endpoint/shim_database_file_creation.yml

@@ -32,9 +32,8 @@ tags:
   - CIS 8
   confidence: 80
   context:
-  - source:endpoint
-  - stage: Privilege Escalation
-  - Persistence
+  - Source:Endpoint
+  - Stage:Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log
   impact: 70
@@ -52,9 +51,9 @@ tags:
     role:
     - Victim
   - name: file_path
-    type: file path
+    type: File
     role:
-    - Others
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/silentcleanup_uac_bypass.yml

@@ -29,10 +29,9 @@ tags:
   confidence: 90
   context:
   - Source:Endpoint
-  - Stage:Persistence,
+  - Stage:Persistence
   - Stage:Privilege Escalation
   - Stage:Defense Evasion
-  - Scope:Incoming
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
   impact: 70

detections/endpoint/single_letter_process_on_endpoint.yml

@@ -31,8 +31,8 @@ tags:
   - CIS 2
   confidence: 90
   context:
-  - source:endpoint
-  - stage: Execution
+  - Source:Endpoint
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon.log
   impact: 70

detections/endpoint/sqlite_module_in_temp_folder.yml

@@ -44,7 +44,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/suspicious_icedid_rundll32_cmdline.yml

@@ -47,7 +47,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/suspicious_image_creation_in_appdata_folder.yml

@@ -52,7 +52,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -48,7 +48,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/suspicious_rundll32_plugininit.yml

@@ -47,7 +47,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/suspicious_wav_file_in_appdata_folder.yml

@@ -51,7 +51,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product:

detections/endpoint/uninstall_app_using_msiexec.yml

@@ -46,7 +46,7 @@ tags:
     role:
     - Victim
   - name: process_name
-    type: process name
+    type: Process
     role:
     - Attacker
   product: