From 5be5ec5b53ecf0e68da28a122f5fcc7eaab2d477 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 8 Dec 2020 14:56:39 -0800 Subject: [PATCH] app inspect failures fixes --- baselines/discover_dns_records.yml | 2 +- detections/network/dns_record_changed.yml | 2 +- lookups/discovered_dns_records.csv | 1 + lookups/previously_seen_running_windows_services.csv | 0 lookups/ransomware_extensions.csv | 4 ++-- macros/clients_connecting_to_multiple_dns_servers.yml | 3 --- macros/create_or_delete_windows_shares.yml | 3 --- macros/detect_traffic_mirroring_filter.yml | 3 --- macros/ec2_excessive_runinstances_mltk_input_filter.yml | 3 --- macros/ec2_excessive_terminateinstances_mltk_input_filter.yml | 3 --- 10 files changed, 5 insertions(+), 19 deletions(-) delete mode 100644 lookups/previously_seen_running_windows_services.csv delete mode 100644 macros/clients_connecting_to_multiple_dns_servers.yml delete mode 100644 macros/create_or_delete_windows_shares.yml delete mode 100644 macros/detect_traffic_mirroring_filter.yml delete mode 100644 macros/ec2_excessive_runinstances_mltk_input_filter.yml delete mode 100644 macros/ec2_excessive_terminateinstances_mltk_input_filter.yml diff --git a/baselines/discover_dns_records.yml b/baselines/discover_dns_records.yml index 0e0e13b35b..805dd07e7b 100644 --- a/baselines/discover_dns_records.yml +++ b/baselines/discover_dns_records.yml @@ -18,7 +18,7 @@ search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T ci DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer - | outputlookup createinapp=true discovered_dns_records.csv' + | outputlookup createinapp=true discovered_dns_records' tags: analytics_story: - DNS Hijacking diff --git a/detections/network/dns_record_changed.yml b/detections/network/dns_record_changed.yml index b5880cc72b..41d7d2f2fd 100644 --- a/detections/network/dns_record_changed.yml +++ b/detections/network/dns_record_changed.yml @@ -20,7 +20,7 @@ how_to_implement: "To successfully implement this search you will need to ensure \n" type: ESCU author: Jose Hernandez, Splunk -search: '| inputlookup discovered_dns_records.csv | rename answer as discovered_answer +search: '| inputlookup discovered_dns_records | rename answer as discovered_answer | join domain[|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query diff --git a/lookups/discovered_dns_records.csv b/lookups/discovered_dns_records.csv index e69de29bb2..74b7ee36f5 100644 --- a/lookups/discovered_dns_records.csv +++ b/lookups/discovered_dns_records.csv @@ -0,0 +1 @@ +count,domain,type,query,answer \ No newline at end of file diff --git a/lookups/previously_seen_running_windows_services.csv b/lookups/previously_seen_running_windows_services.csv deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index d226ac48d4..042da753dc 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -106,7 +106,7 @@ Extensions,Name .kostya,Kostya .kratos,KratosCrypt .LeChiffre,LeChiffre -.locky +.locky,Locky .zepto,Locky .odin,Locky .shit,Locky @@ -289,4 +289,4 @@ Extensions,Name .wnry,WannaCry .wncryt,WannaCry .WNCRYT,WannaCry -.RYK,Ryuk +.RYK,Ryuk \ No newline at end of file diff --git a/macros/clients_connecting_to_multiple_dns_servers.yml b/macros/clients_connecting_to_multiple_dns_servers.yml deleted file mode 100644 index 321abb10e9..0000000000 --- a/macros/clients_connecting_to_multiple_dns_servers.yml +++ /dev/null @@ -1,3 +0,0 @@ -description: Use this macro to add additional filters for monitoring clients connecting to multiple dns servers -name: clients_connecting_to_multiple_dns_servers_output_filter -definition: search * diff --git a/macros/create_or_delete_windows_shares.yml b/macros/create_or_delete_windows_shares.yml deleted file mode 100644 index dfbc9d6b08..0000000000 --- a/macros/create_or_delete_windows_shares.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: search * -description: Use this macro to add additional filter for create or delete windows shares -name: create_or_delete_windows_shares_filter diff --git a/macros/detect_traffic_mirroring_filter.yml b/macros/detect_traffic_mirroring_filter.yml deleted file mode 100644 index 3749765044..0000000000 --- a/macros/detect_traffic_mirroring_filter.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: search * -description: Use this macro to add additional filters to prevent i.e. false positives -name: detect_traffic_mirroring_filter diff --git a/macros/ec2_excessive_runinstances_mltk_input_filter.yml b/macros/ec2_excessive_runinstances_mltk_input_filter.yml deleted file mode 100644 index 84c7096eb8..0000000000 --- a/macros/ec2_excessive_runinstances_mltk_input_filter.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: search * -description: Use this macro to add additional filters -name: ec2_excessive_runinstances_mltk_input_filter diff --git a/macros/ec2_excessive_terminateinstances_mltk_input_filter.yml b/macros/ec2_excessive_terminateinstances_mltk_input_filter.yml deleted file mode 100644 index 009da1e1a9..0000000000 --- a/macros/ec2_excessive_terminateinstances_mltk_input_filter.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: search * -description: Use this macro to add additional filters -name: ec2_excessive_terminateinstances_mltk_input_filter