From 63ec24ad568d7e411ff044bc419d62d5bb2e4e08 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Tue, 2 Feb 2021 15:01:30 -0800 Subject: [PATCH] Improved regex to handle paths - changed regex for paths - updated unit test & data --- detections/endpoint/ssa___first_time_seen_cmd_line.yml | 2 +- tests/endpoint/ssa___first_time_seen_cmd_line.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 0bc478eb95..968255de4f 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), - cmd_line_norm=replace(cmd_line, /\w:\\[^\s]+/, "PATH"), + cmd_line_norm=replace(cmd_line, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N") | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true diff --git a/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml b/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml index 4df1563bb6..08b4193fe6 100644 --- a/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml +++ b/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml @@ -2,7 +2,7 @@ name: First time seen command line argument - SSA Unit Test tests: - name: First time seen command line argument file: endpoint/ssa___first_time_seen_cmd_line.yml - pass_condition: '@count_eq(3)' + pass_condition: '@count_eq(4)' description: Test detection of first time seen command attack_data: - file_name: first_time_seen_commandline.json