diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 77359896c7..38aecc2169 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -49,6 +49,7 @@ action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} action.risk = 1 action.risk.param._risk_message = {{ detection.risk_message }} action.risk.param._risk = {{ detection.risk | tojson }} +action.risk.param._risk_score = 0 action.risk.param.verbose = 0 {% endif %} {% else %} diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index ed4c8cdbf8..65b5a4d055 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -625,7 +625,7 @@ references = ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injectio maintainers = [{"company": "no", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"] -description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' +description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Splunk Investigation', 'Log4j Investigate', 'Log4j Respond' narrative = In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called ["A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system. [analytic_story://Malicious PowerShell] diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index b257498dce..88d42531c5 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 4848 +build = 4868 [triggers] reload.analytic_stories = simple diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index e0038d4056..f2922d4abb 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 3760d30279..ba0d1ab194 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -337,7 +337,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_log4shell_cve_2021_44228] label = Log4Shell CVE-2021-44228 -description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' +description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Log4j Splunk Investigation', 'Log4j Investigate', 'Log4j Respond' disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task"] diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 7a4bc6a975..4770aee3f3 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 6769f2872d..2f8d2bb9c8 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 776e07cdfa..ee04138b48 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-02T18:04:53 UTC +# On Date: 2022-02-02T18:43:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com #############