From 3e44ef77fa14a268701e5bd13b76ddd60ee53ba7 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 20 Apr 2021 12:49:32 -0700 Subject: [PATCH 1/4] validate check for search length name --- bin/validate.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/bin/validate.py b/bin/validate.py index d0da8ab741..ed97c5196c 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -118,6 +118,9 @@ def validate_standard_fields(object, uuids): else: uuids.append(object['id']) + if (object['type']) == 'batch' and len(object['name']) > 75: + errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name'])) + # if object['name'].endswith(" "): # errors.append( # "ERROR: name has trailing spaces: '%s'" % From c0e9a5dc1d105269f42eb6649b9af6d3efa76cfd Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 20 Apr 2021 13:10:00 -0700 Subject: [PATCH 2/4] search name and file renames --- ...wershell_execution_policy_to_unrestricted_or_bypass.yml} | 2 +- ...ell_execution_policy_to_unrestricted_or_bypass.test.yml} | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml => set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml} (96%) rename tests/endpoint/{attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml => set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml} (59%) diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml similarity index 96% rename from detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml rename to detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 1bd7e82992..46dafd2e22 100644 --- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,4 +1,4 @@ -name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass +name: Set PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d version: 6 date: '2020-11-06' diff --git a/tests/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml b/tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml similarity index 59% rename from tests/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml rename to tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml index efcb210456..d45f44ce25 100644 --- a/tests/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml +++ b/tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml @@ -1,7 +1,7 @@ -name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test +name: Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test tests: -- name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - file: endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +- name: Set Default PowerShell Execution Policy To Unrestricted or Bypass + file: endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 8e12d73bdeb734ebb7b5e583628cacef04cd657e Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 20 Apr 2021 13:14:33 -0700 Subject: [PATCH 3/4] minor --- ...lt_powershell_execution_policy_to_unrestricted_or_bypass.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 46dafd2e22..726369ecbf 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` - | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' + | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be ingesting logs with the fields registry_path, registry_key_name, and registry_value_name From 609c1e275ec3d03b0c0026054763ffbd9e218247 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 20 Apr 2021 13:24:16 -0700 Subject: [PATCH 4/4] minor --- ...lt_powershell_execution_policy_to_unrestricted_or_bypass.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 726369ecbf..5fa61fe30d 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,4 +1,4 @@ -name: Set PowerShell Execution Policy To Unrestricted or Bypass +name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d version: 6 date: '2020-11-06'