Branch was auto-updated.

bin/contentctl_project/contentctl_core/application/factory/new_content_factory.py

@@ -91,3 +91,18 @@ class NewContentFactory():
             self.output_dto.obj['tags']['category'] = answers['category']
             self.output_dto.obj['tags']['product'] = ['Splunk Enterprise','Splunk Enterprise Security','Splunk Cloud']
             self.output_dto.obj['tags']['usecase'] = answers['usecase']
+
+
+        elif input_dto.type == SecurityContentType.attack_data:
+            questions = NewContentQuestions.get_questions_attack_data()
+            answers = questionary.prompt(questions)
+            self.output_dto.obj['author'] = answers['author_name']
+            self.output_dto.obj['id'] = str(uuid.uuid4())
+            self.output_dto.obj['date'] = datetime.today().strftime('%Y-%m-%d')
+            self.output_dto.obj['description'] = "description"
+            self.output_dto.obj['environment'] = "attackrange"
+            self.output_dto.obj['dataset'] = "datasets"
+            self.output_dto.obj['sourcetypes'] = answers['data_src_category']
+            self.output_dto.obj['references'] = [answers['references']]
+            self.output_dto.obj['src_path'] = answers['src_file_path'].strip()
+            self.output_dto.obj['dst_path'] = answers['dest_file_path'].strip()

bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py

@@ -169,4 +169,88 @@ class NewContentQuestions():
                 ],
             },
         ]
+        return questions
+
+
+    @classmethod
+    def get_questions_attack_data(self) -> list:
+        questions = [
+            {
+                'type': 'input',
+                'message': 'enter the source file path of your attack_dataset (ex. ~/attack_range/attack_data/stext_sysmon/sysmon.log): ',
+                'name': 'src_file_path',
+            },
+            {
+                'type': 'input',
+                'message': 'enter the dest folder path for your attack_dataset (ex. ~/attack_data/datasets/malware/remcos/remcos_dynwrapx): ',
+                'name': 'dest_file_path',
+            },
+            {
+                'type': 'input',
+                'message': 'enter author name: ',
+                'name': 'author_name',
+                'default': 'STRT',
+            },
+            {
+            'type': 'checkbox',
+            'message': 'select the data source type',
+            'name': 'data_src_category',
+            'choices': [
+                {
+                    'name': 'windows-sysmon.log',
+                    'checked': True
+                },
+                {
+                    'name': 'windows-security.log'
+                },
+                {
+                    'name': 'windows-system.log'
+                },
+                {
+                    'name': 'windows-powershell-xml.log'
+                },
+                {
+                    'name': 'stream_http_events.log'
+                },
+                {
+                    'name': 'aws_cloudtrail_events.json'
+                },
+                {
+                    'name': 'o365_events.json'
+                },
+                {
+                    'name': 'o365_exchange_events.json'
+                },
+                {
+                    'name': 'kubernetes_events.json'
+                },
+                {
+                    'name': 'security_hub_finding.json'
+                },
+                {
+                    'name': 'gsuite_gmail_bigquery.json'
+                },
+                {
+                    'name': 'gsuite_drive_json.json'
+                },
+                {
+                    'name': 'github.json'
+                },
+                {
+                    'name': 'kubernetes_nginx.json'
+                },
+                {
+                    'name': 'circleci.json'
+                },
+                {
+                    'name': 'sysmon_linux.log'
+                },
+                ],
+            },
+            {
+                'type': 'input',
+                'message': 'enter references: ',
+                'name': 'references',
+            },
+        ]
         return questions

bin/contentctl_project/contentctl_core/application/use_cases/new_content.py

@@ -19,4 +19,14 @@ class NewContent:
         factory = NewContentFactory(factory_output_dto)
         factory.execute(input_dto.factory_input_dto)
 
-        input_dto.adapter.writeObjectNewContent(factory_output_dto.obj, input_dto.factory_input_dto.type)
+        input_dto.adapter.writeObjectNewContent(factory_output_dto.obj, input_dto.factory_input_dto.type)
+
+
+class NewAttackDataContent:
+
+    def execute(self, input_dto: NewContentInputDto) -> None:
+        factory_output_dto = NewContentFactoryOutputDto(dict())
+        factory = NewContentFactory(factory_output_dto)
+        factory.execute(input_dto.factory_input_dto)
+
+        input_dto.adapter.writeObjects(factory_output_dto.obj, input_dto.factory_input_dto.type)

bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py

@@ -36,6 +36,7 @@ class SecurityContentType(enum.Enum):
     deployments = 7
     investigations = 8
     unit_tests = 9
+    attack_data = 10
 
 class SecurityContentProduct(enum.Enum):
     ESCU = 1

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py

@@ -0,0 +1,112 @@
+import os
+import re
+from pathlib import Path
+from bin.contentctl_project.contentctl_infrastructure.adapter.yml_writer import YmlWriter
+from bin.contentctl_project.contentctl_core.application.adapter.adapter import Adapter
+from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType
+import shutil
+
+class ObjToAttackDataYmlAdapter(Adapter):
+
+    def __init__(self):
+        self.ATTACK_DATASET_LINK = "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets"
+        self.sourcetype_dict = {
+        'windows-sysmon.log':'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational', 
+        'windows-security.log': 'WinEventLog:Security',
+        'windows-system.log': 'WinEventLog:system',
+        'windows-powershell-xml.log' :'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational',
+        'stream_http_events.log' :'stream:http',
+        'aws_cloudtrail_events.json' :'aws:cloudtrail',
+        'o365_events.json' :'o365:management:activity',
+        'o365_exchange_events.json' :'o365:management:activity',
+        'kubernetes_events.json' :'kubernetes',
+        'security_hub_finding.json' :'aws:securityhub:finding',
+        'gsuite_gmail_bigquery.json' :'gsuite:gmail:bigquery',
+        'gsuite_drive_json.json':'gsuite:drive:json',
+        'github.json' : 'aws:firehose:json',
+        'kubernetes_nginx.json' :'kube:container:controller',
+        'circleci.json' :'circleci',
+        'sysmon_linux.log' :'Syslog:Linux-Sysmon/Operational'                               
+        }
+        return
+
+    def banner(self):
+        print("""
+        inspired from contentctl.py ...
+        running attack dataset utility helper. 
+        warming up "Millenium Falcon"...  
+                      c==o
+                    _/____\_
+            _.,--'" ||^ || "`z._
+            /_/^ ___\||  || _/o\ "`-._
+            _/  ]. L_| || .||  \_/_  . _`--._
+        /_~7  _ . " ||. || /] \ ]. (_)  . "`--.
+        |__7~.(_)_ []|+--+|/____T_____________L|
+        |__|  _^(_) /^   __\____e_   _|
+        |__| (_){_) J ]K{__ L___0_   _]
+        |__| . _(_) \v     /__________|________
+        l__l_ (_). []|+-+-<\^   L  . _   - ---L|
+        \__\    __. ||^l  \Y] /_]  (_) .  _,--'
+            \~_]  L_| || .\ .\\/~.    _,--'"
+            \_\ . __/||  |\  \`-+-<'"
+                "`---._|J__L|X o~~|[\\      
+        -Row      \____/ \___|[//      
+                   `--'   `--+-'
+        """)
+
+    def expand_path(self, in_path: str) -> str:
+        if "~" in in_path:
+            return str(in_path).replace("~", str(Path.home()))
+        else:
+            return in_path
+
+
+    def extract_base_path(self, in_path: str) -> str:
+        return os.path.basename(os.path.normpath(self.expand_path(in_path)))
+
+
+    def gen_attack_data_descp(self, in_path: str) -> str:
+        descp = "Generated datasets for {} in attack range.".format(self.extract_base_path(self.expand_path(in_path)).replace("_"," "))
+        return descp
+
+
+    def writeObjects(self, objects: list, output_path: str, type: SecurityContentType = None) -> None:
+
+        ## check if src_path exist
+        expanded_src_path = self.expand_path(objects['src_path'])
+        expanded_dst_path = self.expand_path(objects['dst_path'])
+        try:
+            st = os.stat(expanded_src_path)
+        except os.error:
+            print("[x] ERROR: File {0} is not exist".format(objects['src_path']))
+            exit()
+
+        ## check if dest_path exist
+        if not os.path.isdir(expanded_dst_path):
+            os.makedirs(expanded_dst_path, exist_ok=True)
+            
+        objects['description'] = self.gen_attack_data_descp(objects['dst_path'])
+        
+        objects['dataset'] = [self.ATTACK_DATASET_LINK + objects['dst_path'].split("datasets")[1] + os.sep + self.extract_base_path(objects['src_path'])]
+        
+        objects['sourcetypes'] = [self.sourcetype_dict[objects['sourcetypes'][0]]]
+        
+        attack_data_yml_file = expanded_dst_path + os.sep + self.extract_base_path(objects['dst_path']).replace(" ", "_") + ".yml"
+        
+        ## copy the dataset to the destination folder
+        shutil.copy(expanded_src_path, expanded_dst_path)
+
+        objects.pop('src_path')
+        
+        objects.pop('dst_path')
+        
+        YmlWriter.writeYmlFile(attack_data_yml_file, objects)
+
+        ## read attackdata file
+        with open(attack_data_yml_file, 'r') as f:
+            self.banner()
+            print("[+] ----------- generated attack data yml file ------------\n")
+            print(f.read())
+
+
+

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/security_services.csv

@@ -1,5 +1,5 @@
 service,description,category
 *mpssvc*,Windows Firewall Service,security
-*wscsvc*,Windows Security Center Service,securty
+*wscsvc*,Windows Security Center Service,security
 *windefend*,Windows Defender Service,security
 *sysmon*,Sysmon Driver,security

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/windows_protocol_handlers.csv

@@ -0,0 +1,205 @@
+handler,ishandler
+"*bingmaps:*",TRUE
+"*calculator:*",TRUE
+"*callto:*",TRUE
+"*conf:*",TRUE
+"*DLNA-PLAYSINGLE:*",TRUE
+"*Explorer.AssocActionId.BurnSelection:*",TRUE
+"*Explorer.AssocActionId.EraseDisc:*",TRUE
+"*Explorer.AssocActionId.ZipSelection:*",TRUE
+"*Explorer.AssocProtocol.search-ms:*",TRUE
+"*Explorer.BurnSelection:*",TRUE
+"*Explorer.EraseDisc:*",TRUE
+"*Explorer.ZipSelection:*",TRUE
+"*feed:*",TRUE
+"*feeds:*",TRUE
+"*file:*",TRUE
+"*FirefoxURL-308046B0AF4A39CB:*",TRUE
+"*ftp:*",TRUE
+"*grvopen:*",TRUE
+"*http:*",TRUE
+"*https:*",TRUE
+"*iehistory:*",TRUE
+"*ierss:*",TRUE
+"*im:*",TRUE
+"*LDAP:*",TRUE
+"*Lync15:*",TRUE
+"*Lync15classic:*",TRUE
+"*ma-chan:*",TRUE
+"*ma-filelink:*",TRUE
+"*mailto:*",TRUE
+"*mapi:*",TRUE
+"*mapi15:*",TRUE
+"*mapi16:*",TRUE
+"*mk:*",TRUE
+"*MMS:*",TRUE
+"*ms-access:*",TRUE
+"*ms-actioncenter:*",TRUE
+"*ms-apprep:*",TRUE
+"*ms-availablenetworks:*",TRUE
+"*ms-cortana:*",TRUE
+"*ms-cxh:*",TRUE
+"*ms-device-enrollment:*",TRUE
+"*ms-excel:*",TRUE
+"*ms-msdt:*",TRUE
+"*ms-penworkspace:*",TRUE
+"*ms-powerpoint:*",TRUE
+"*ms-publisher:*",TRUE
+"*ms-settings:*",TRUE
+"*ms-settings-airplanemode:*",TRUE
+"*ms-settings-bluetooth:*",TRUE
+"*ms-settings-cellular:*",TRUE
+"*ms-settings-connectabledevices:*",TRUE
+"*ms-settings-displays-topology:*",TRUE
+"*ms-settings-emailandaccounts:*",TRUE
+"*ms-settings-language:*",TRUE
+"*ms-settings-location:*",TRUE
+"*ms-settings-lock:*",TRUE
+"*ms-settings-mobilehotspot:*",TRUE
+"*ms-settings-notifications:*",TRUE
+"*ms-settings-power:*",TRUE
+"*ms-settings-privacy:*",TRUE
+"*ms-settings-proximity:*",TRUE
+"*ms-settings-screenrotation:*",TRUE
+"*ms-settings-wifi:*",TRUE
+"*ms-settings-workplace:*",TRUE
+"*ms-teams:*",TRUE
+"*ms-windows-search:*",TRUE
+"*ms-word:*",TRUE
+"*mssharepointclient:*",TRUE
+"*msteams:*",TRUE
+"*mswindowsmusic:*",TRUE
+"*mswindowsvideo:*",TRUE
+"*odopen:*",TRUE
+"*OneIndex16:*",TRUE
+"*OneNote:*",TRUE
+"*OneNote.URL.16:*",TRUE
+"*OneNoteDesktop:*",TRUE
+"*OneNoteDesktop.URL.16:*",TRUE
+"*Outlook.URL.feed.15:*",TRUE
+"*Outlook.URL.mailto.15:*",TRUE
+"*Outlook.URL.stssync.15:*",TRUE
+"*Outlook.URL.webcal.15:*",TRUE
+"*res:*",TRUE
+"*rlogin:*",TRUE
+"*search:*",TRUE
+"*search-ms:*",TRUE
+"*sip:*",TRUE
+"*sips:*",TRUE
+"*skypecast15:*",TRUE
+"*stssync:*",TRUE
+"*tbauth:*",TRUE
+"*tel:*",TRUE
+"*telnet:*",TRUE
+"*tn3270:*",TRUE
+"*webcal:*",TRUE
+"*webcals:*",TRUE
+"*windows.tbauth:*",TRUE
+"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE
+"*WMP11.AssocProtocol.MMS:*",TRUE
+"*Word:*",TRUE
+"*xbox-tcui:*",TRUE
+"*appinstaller.oauth2:*",TRUE
+"*bingnews:*",TRUE
+"*bingweather:*",TRUE
+"*feedback-hub:*",TRUE
+"*git-client:*",TRUE
+"*IE.HTTP:*",TRUE
+"*insiderhub:*",TRUE
+"*microsoft-edge:*",TRUE
+"*microsoft-edge-holographic:*",TRUE
+"*microsoft.windows.camera:*",TRUE
+"*microsoft.windows.camera.multipicker:*",TRUE
+"*microsoft.windows.camera.picker:*",TRUE
+"*microsoft.windows.photos.crop:*",TRUE
+"*microsoft.windows.photos.picker:*",TRUE
+"*microsoft.windows.photos.videoedit:*",TRUE
+"*Microsoft.Workfolders:*",TRUE
+"*microsoftvideo:*",TRUE
+"*ms-aad-brokerplugin:*",TRUE
+"*ms-appinstaller:*",TRUE
+"*ms-calculator:*",TRUE
+"*ms-clock:*",TRUE
+"*ms-contact-support:*",TRUE
+"*ms-cortana2:*",TRUE
+"*ms-cxh-full:*",TRUE
+"*ms-default-location:*",TRUE
+"*ms-device-enrollment2:*",TRUE
+"*ms-drive-to:*",TRUE
+"*ms-edu-secureassessment:*",TRUE
+"*ms-eyecontrolspeech:*",TRUE
+"*ms-gamebar:*",TRUE
+"*ms-gamebarservices:*",TRUE
+"*ms-gamingoverlay:*",TRUE
+"*ms-get-started:*",TRUE
+"*ms-getoffice:*",TRUE
+"*ms-inputapp:*",TRUE
+"*ms-insights:*",TRUE
+"*ms-meetnow:*",TRUE
+"*ms-meetnowflyout:*",TRUE
+"*ms-mmsys:*",TRUE
+"*ms-msime-imepad:*",TRUE
+"*ms-msime-imjpdct:*",TRUE
+"*ms-officeapp:*",TRUE
+"*ms-officecmd:*",TRUE
+"*ms-oobenetwork:*",TRUE
+"*ms-people:*",TRUE
+"*ms-perception-simulation:*",TRUE
+"*ms-phone:*",TRUE
+"*ms-photos:*",TRUE
+"*ms-powerautomate:*",TRUE
+"*ms-print-addprinter:*",TRUE
+"*ms-print-printjobs:*",TRUE
+"*ms-quick-assist:*",TRUE
+"*ms-rdx-document:*",TRUE
+"*ms-retaildemo-launchbioenrollment:*",TRUE
+"*ms-retaildemo-launchstart:*",TRUE
+"*ms-screenclip:*",TRUE
+"*ms-screensketch:*",TRUE
+"*ms-search:*",TRUE
+"*ms-sttoverlay:*",TRUE
+"*ms-taskswitcher:*",TRUE
+"*ms-to-do:*",TRUE
+"*ms-todo:*",TRUE
+"*ms-unistore-email:*",TRUE
+"*ms-virtualtouchpad:*",TRUE
+"*ms-walk-to:*",TRUE
+"*ms-wcrv:*",TRUE
+"*ms-windows-store:*",TRUE
+"*ms-windows-store-deskext:*",TRUE
+"*ms-windows-store2:*",TRUE
+"*ms-wpc:*",TRUE
+"*ms-wpdrmv:*",TRUE
+"*ms-wxh:*",TRUE
+"*ms-xbet-survey:*",TRUE
+"*ms-xbl-3d8b930f:*",TRUE
+"*ms-xgpueject:*",TRUE
+"*msgamepass:*",TRUE
+"*msgamingapp:*",TRUE
+"*msnews:*",TRUE
+"*msnnews:*",TRUE
+"*msnweather:*",TRUE
+"*msxbox:*",TRUE
+"*outlookaccounts:*",TRUE
+"*outlookcal:*",TRUE
+"*outlookmail:*",TRUE
+"*read:*",TRUE
+"*vscode:*",TRUE
+"*vsls:*",TRUE
+"*vstfs:*",TRUE
+"*vsweb:*",TRUE
+"*windows-feedback:*",TRUE
+"*windowsdefender:*",TRUE
+"*xboxliveapp-1297287741:*",TRUE
+"*zune:*",TRUE
+"*SecureBrowser.security.getDeviceInfo:*",TRUE
+"*SecureBrowser.security.getMACAddress:*",TRUE
+"*SecureBrowser.security.examineProcessList:*",TRUE
+"*SecureBrowser.security.isRemoteSession:*",TRUE
+"*SecureBrowser.security.isVMSession:*",TRUE
+"*JavaScript:*",TRUE
+"*vbscript:*",TRUE
+"*about:*",TRUE
+"*ms-its:*",TRUE
+"*its:*",TRUE
+"*mk:@MSITStore:*",TRUE

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json

@@ -1 +1 @@
-{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}
+{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json

@@ -1 +1 @@
-{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "check_references": false, "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/private/tmp/pytest/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]}
+{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/p4t12ick/projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection", "providing_technologies": ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json

@@ -1 +1 @@
-{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
+{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json

@@ -1 +1 @@
-{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "check_references": false, "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]}
+{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]}

contentctl.py

@@ -10,7 +10,7 @@ from bin.contentctl_project.contentctl_core.application.use_cases.content_change
 from bin.contentctl_project.contentctl_core.application.use_cases.generate import GenerateInputDto, Generate
 from bin.contentctl_project.contentctl_core.application.use_cases.validate import ValidateInputDto, Validate
 from bin.contentctl_project.contentctl_core.application.use_cases.doc_gen import DocGenInputDto, DocGen
-from bin.contentctl_project.contentctl_core.application.use_cases.new_content import NewContentInputDto, NewContent
+from bin.contentctl_project.contentctl_core.application.use_cases.new_content import NewContentInputDto, NewContent, NewAttackDataContent
 from bin.contentctl_project.contentctl_core.application.use_cases.reporting import ReportingInputDto, Reporting
 from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryInputDto
 from bin.contentctl_project.contentctl_core.application.factory.ba_factory import BAFactoryInputDto
@@ -33,7 +33,7 @@ from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_svg_adapter
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_attack_nav_adapter import ObjToAttackNavAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType
-
+from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_attackdata_yml_adapter import ObjToAttackDataYmlAdapter
 
 def init():
 
@@ -238,13 +238,19 @@ def new_content(args) -> None:
         contentType = SecurityContentType.detections
     elif args.type == 'story':
         contentType = SecurityContentType.stories
+    elif args.type == 'attack_data':
+        contentType = SecurityContentType.attack_data
     else:
         print("ERROR: type " + args.type + " not supported")
         sys.exit(1)
 
     new_content_factory_input_dto = NewContentFactoryInputDto(contentType)
-    new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter(args.path))
-    new_content = NewContent()
+    if args.type == 'attack_data':
+        new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToAttackDataYmlAdapter())
+        new_content = NewAttackDataContent()
+    else:
+        new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter(args.path))
+        new_content = NewContent()
     new_content.execute(new_content_input_dto)
 
 
@@ -296,6 +302,7 @@ def main(args):
     new_content_parser = actions_parser.add_parser("new_content", help="Create new security content object")
     reporting_parser = actions_parser.add_parser("reporting", help="Create security content reporting")
 
+
     
 
     # # new arguments