From ca2f6bd661afe37c9e56662c84d068bec2b4a810 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Fri, 5 Nov 2021 09:30:00 -0700 Subject: [PATCH 1/2] Fixing lowercasing of entitiy ids, which must not be done for SSA. --- .../endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml | 6 +++--- .../endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index f65c51a9d1..d834998fe7 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -11,9 +11,9 @@ description: This detection identifies potential Pass the Token or Pass the Hash by a detination device. search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), - "string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), - "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), + "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), + "string", null), dest_device_id= ucast(map_get(input_event, "dest_device_id"), + "string", null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 1c6f185310..b4f657bba2 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -11,10 +11,10 @@ description: This detection identifies potential Pass the Token or Pass the Hash by an event-collecting device (i.e., a specific domain controller or an endpoint destination). search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), - "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), - "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), + "_time"), "string", null)), dest_user= ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null), dest_user_id= ucast(map_get(input_event, "dest_user_id"), + "string", null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), + "string", null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) From 4e9565814ed9058237324fac2c32349321690c61 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Fri, 5 Nov 2021 09:54:08 -0700 Subject: [PATCH 2/2] Bringing back lowercase for a dest user name. --- detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index b4f657bba2..ca47f62d57 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -11,8 +11,8 @@ description: This detection identifies potential Pass the Token or Pass the Hash by an event-collecting device (i.e., a specific domain controller or an endpoint destination). search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null), dest_user_id= ucast(map_get(input_event, "dest_user_id"), + "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string", null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),