proposal

dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -23,7 +23,6 @@ search:
       - opera.exe
       - firefox.exe
       - powershell.exe
-      - 
   selection2:
     parent_process_name: java.exe
   selection3:
@@ -77,7 +76,7 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
-  - process
+  - cmd_line
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -3,60 +3,19 @@ id: 63614a58-10e2-4c6c-ae81-ea1113681439
 version: 1
 description: The following detection identifies the usage of archive tools from the
   command line.
-search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
-  null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
-  null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
-  process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
-  "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
+search: ' | from read_ba_enriched_events()  
+  | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
   OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe")
   OR like(actor_process_file_name, "%cmd.exe")) 
   | eval body=create_map(
-    "activity_id", 1,
-    "analytic_stories", ["Cobalt Strike", "NOBELIUM Group", "Insider Threat"],
-    "cis_csc", [create_map("control", "CIS 10", "version", 7)],
-    "category_uid", 2,
-    "class_name", "Detection Report",
-    "class_uid", 102001,
-    "confidence", 60,
-    "confidence_id", 2,
     "devices", [
         create_map(
             "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
         )
     ],
-    "duration", 0,
-    "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "impact", 70,
-    "impact_id", 4,
-    "kill_chain", [create_map("phase", "Exploitation", "phase_id", 4)],
-    "attacks", [create_map("tactics", [create_map("name", "Collection", "uid", "TA0009")], "technique", create_map("name", "Archive via Utility", "uid", "T1560.001"), "version", "12.1"), create_map("tactics", [create_map("name", "Collection", "uid", "TA0009")], "technique", create_map("name", "Archive Collected Data", "uid", "T1560"), "version", "12.1")],  
+    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),  
     "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", process_user_name, "."),
-    "metadata", create_map(
-        "product", create_map(
-            "name", "Behavioral Analytic Service",
-            "vendor_name", "Splunk"
-        ),
-        "version", "1.0.0"
-    ),
-    "nist", ["DE.AE"],
     "observables", [create_map("name", "process.user.name", "type_id", 4, "value", process_user_name), create_map("name", "device.hostname", "type_id", 1, "value", device_hostname), create_map("name", "process.file.name", "type_id", 7, "value", process_file_name), create_map("name", "process.cmd_line", "type_id", 99, "value", process_cmd_line), create_map("name", "actor.process.file.name", "type_id", 7, "value", actor_process_file_name)],
-    "risk_level", "Medium",
-    "risk_level_id", 2,
-    "risk_score", 42,
-    "severity_id", 4,
-    "type_uid", 10200101,
     "users", [
         create_map(
             "name", process_user_name, "uuid", ucast(map_get(device,"uuid"), "string", null)
@@ -72,19 +31,20 @@ known_false_positives: False positives can be ligitmate usage of archive tools f
 references:
 - https://attack.mitre.org/techniques/T1560/001/
 tags:
-  analytic_story:
-  - Cobalt Strike
-  - NOBELIUM Group
-  - Insider Threat
-  cis20:
-  - CIS 10
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1560.001
-  - T1560
-  nist:
-  - DE.AE
+  annotations:
+    analytic_story:
+    - Cobalt Strike
+    - NOBELIUM Group
+    - Insider Threat
+    cis20:
+    - CIS 10
+    kill_chain_phases:
+    - Exploitation
+    mitre_attack_id:
+    - T1560.001
+    - T1560
+    nist:
+    - DE.AE
   required_fields:
   - process.user.name
   - device.hostname