From 63d6194192027027e5751c96f1ef8debeb277954 Mon Sep 17 00:00:00 2001 From: bpatel Date: Fri, 12 Apr 2019 18:03:52 -0700 Subject: [PATCH 1/4] outlook search --- detections/outlook_writing_zip.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/outlook_writing_zip.json b/detections/outlook_writing_zip.json index e76cec26a4..9b57790dc2 100644 --- a/detections/outlook_writing_zip.json +++ b/detections/outlook_writing_zip.json @@ -39,7 +39,7 @@ "earliest_time": "-70m@m", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user| `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | join [| tstats `summariesonly` values(Filesystem.file_path) as file_path count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*.zip by Filesystem.process_id Filesystem.file_hash Filesystem.dest Filesystem.file_name| `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | fields process_id dest file_path file_name file_hash]", + "search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id type=inner[| tstats `summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\\\Users* OR Filesystem.file_path=*Local\\\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest | `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name != \"\"", "suppress": { "suppress_fields": "dest,file_name", "suppress_period": "86400s" From 86d64712cefe4c3bef45507bb4426ab9697caf5d Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 15 Apr 2019 10:41:37 -0700 Subject: [PATCH 2/4] description: --- stories/phishing_payloads.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/phishing_payloads.json b/stories/phishing_payloads.json index 6f10f9ac44..287f2ff25c 100644 --- a/stories/phishing_payloads.json +++ b/stories/phishing_payloads.json @@ -5,7 +5,7 @@ ], "channel": "ESCU", "creation_date": "2019-04-10", - "description": "XXXX - Placeholder for Phishing description", + "description": "This story contains analytics around detecting payloads from a phishing attack", "detections": [ { "detection_id": "a51bfe1a-94f0-4822-b1e4-16ae10145893", From 920c3397e9db187410e300666243c16dec1248b0 Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 15 Apr 2019 14:01:02 -0700 Subject: [PATCH 3/4] validate.py in CI config --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index ae7c7dd1bd..fb419d413b 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -51,7 +51,7 @@ jobs: command: | cd security-content source venv/bin/activate - python bin/validate_manifests.py --path . + python bin/validate.py --path . - run: name: run manifest to escu command: | From 2663ea9510b455aaf760e1124ef55e420002932e Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 15 Apr 2019 14:10:45 -0700 Subject: [PATCH 4/4] spec update for a mitre field --- investigations/get_certificate_for_domain.json | 10 +++++----- spec/v2/detections.spec.json | 1 + stories/dynamic_dns.json | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/investigations/get_certificate_for_domain.json b/investigations/get_certificate_for_domain.json index d655085eb7..a45fdb665c 100644 --- a/investigations/get_certificate_for_domain.json +++ b/investigations/get_certificate_for_domain.json @@ -21,11 +21,11 @@ "fields_required": [ "domain" ], - "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*{domain} by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `ctime(firstTime)` | `ctime(lastTime)`", - "window": { - "earliest_time_offset": 0, - "latest_time_offset": 86400 - } + "schedule": { + "earliest_time": "0", + "latest_time": "86400" + }, + "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*{domain} by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `ctime(firstTime)` | `ctime(lastTime)`" } }, "maintainers": [ diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 0e502e0a03..e4d2f6ba02 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -893,6 +893,7 @@ "Initial Access", "Execution", "Persistence", + "Spearphishing Attachment", "Privilege Escalation", "Defense Evasion", "Credential Access", diff --git a/stories/dynamic_dns.json b/stories/dynamic_dns.json index c08671698e..b5618ba85f 100644 --- a/stories/dynamic_dns.json +++ b/stories/dynamic_dns.json @@ -3,7 +3,7 @@ "channel": "ESCU", "creation_date": "2017-11-21", "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", - "id": "8169f17b-ef68-4b59-aae8-5869073014e1", + "id": "8169f17b-ef68-4b59-aae8-586907301221", "maintainers": [ { "company": "Splunk",