From e92699f315fde4adf1b57c3793e5629c22d8d2ed Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 24 Jun 2022 14:27:27 -0700 Subject: [PATCH 1/8] st --- .../application/builder/detection_builder.py | 4 ++++ .../contentctl_core/domain/entities/detection.py | 1 + .../adapter/templates/analyticstories_detections.j2 | 2 +- .../builder/security_content_detection_builder.py | 6 ++++++ .../builder/security_content_director.py | 1 + 5 files changed, 13 insertions(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py b/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py index aa182ad107..5121df40e9 100644 --- a/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py +++ b/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py @@ -19,6 +19,10 @@ class DetectionBuilder(abc.ABC): @abc.abstractmethod def addNesFields(self) -> None: pass + + @abc.abstractmethod + def addProvidingTechnologies(self) -> None: + pass @abc.abstractmethod def addMappings(self) -> None: diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index d2bb95035f..ca06949fb3 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -52,6 +52,7 @@ class Detection(BaseModel, SecurityContentObject): file_path: str = None source: str = None nes_fields: str = None + providing_technologies: str = None # @validator('name') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 index 088139df56..83887a2e87 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 @@ -15,7 +15,7 @@ how_to_implement = none {% endif %} annotations = {{ detection.mappings | tojson }} known_false_positives = {{ detection.known_false_positives }} -providing_technologies = [] +providing_technologies = {{ detection.providing_technologies }} {% endif %} {% endfor %} diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 072facd9c0..2a2f97adc3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -89,6 +89,12 @@ class SecurityContentDetectionBuilder(DetectionBuilder): self.security_content_obj.risk = risk_objects + def addProvidingTechnologies(self) -> None: + if self.security_content_obj: + if self.security_content_obj.tags.supported_tas: + if 'Splunk_TA_microsoft_sysmon' in self.security_content_obj.tags.supported_tas: + self.security_content_obj.providing_technologies = ['Sysmon'] + def addNesFields(self) -> None: if self.security_content_obj: diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py index 5475ded773..d040872147 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py @@ -17,6 +17,7 @@ class SecurityContentDirector(Director): builder.setObject(os.path.join(os.path.dirname(__file__), path)) builder.addDeployment(deployments) builder.addRBA() + builder.addProvidingTechnologies() builder.addNesFields() builder.addAnnotations() builder.addMappings() From 690021590a3b9b2a72d760bede040971942f024e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 24 Jun 2022 14:30:58 -0700 Subject: [PATCH 2/8] add MS windows --- .../builder/security_content_detection_builder.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 2a2f97adc3..b684ce2e37 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -93,7 +93,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): if self.security_content_obj: if self.security_content_obj.tags.supported_tas: if 'Splunk_TA_microsoft_sysmon' in self.security_content_obj.tags.supported_tas: - self.security_content_obj.providing_technologies = ['Sysmon'] + self.security_content_obj.providing_technologies = ['Sysmon','Microsoft Windows'] def addNesFields(self) -> None: From d5ab2bd9c8a684d147e5ca711714164a0796138c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 24 Jun 2022 14:42:57 -0700 Subject: [PATCH 3/8] CI --- .../builder/security_content_detection_builder.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index b684ce2e37..8c4cf5e1a5 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -89,7 +89,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): self.security_content_obj.risk = risk_objects - def addProvidingTechnologies(self) -> None: + def addProvidingTechnologies(self) -> None: if self.security_content_obj: if self.security_content_obj.tags.supported_tas: if 'Splunk_TA_microsoft_sysmon' in self.security_content_obj.tags.supported_tas: From 5c1e44eb3254a0ac70056dbc5b19a1512209f837 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Jun 2022 13:49:44 -0700 Subject: [PATCH 4/8] adding more technologieas --- .../builder/security_content_detection_builder.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 8c4cf5e1a5..ebbdd45739 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -91,9 +91,13 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def addProvidingTechnologies(self) -> None: if self.security_content_obj: - if self.security_content_obj.tags.supported_tas: - if 'Splunk_TA_microsoft_sysmon' in self.security_content_obj.tags.supported_tas: - self.security_content_obj.providing_technologies = ['Sysmon','Microsoft Windows'] + # if self.security_content_obj.tags.supported_tas: + if 'Endpoint' in self.security_content_obj.datamodel: + self.security_content_obj.providing_technologies = "['Sysmon', 'Microsoft Windows','Carbon Black Response','CrowdStrike Falcon', 'Symantec Endpoint Protection']" + if "`cloudtrail`" in str(self.security_content_obj.search): + self.security_content_obj.providing_technologies = "['Amazon Web Services - Cloudtrail']" + if '`wineventlog_security`' in self.security_content_obj.search or '`powershell`' in self.security_content_obj.search: + self.security_content_obj.providing_technologies = "['Microsoft Windows']" def addNesFields(self) -> None: From bb3a73b0dd7fe7b3d3217654c35383682b1284b1 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Jun 2022 15:26:45 -0700 Subject: [PATCH 5/8] array --- .../contentctl_core/domain/entities/detection.py | 2 +- .../adapter/templates/analyticstories_detections.j2 | 2 +- .../builder/security_content_detection_builder.py | 8 +++++--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index ca06949fb3..e8786f6d2a 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -52,7 +52,7 @@ class Detection(BaseModel, SecurityContentObject): file_path: str = None source: str = None nes_fields: str = None - providing_technologies: str = None + providing_technologies: list = None # @validator('name') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 index 83887a2e87..55ea109895 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2 @@ -15,7 +15,7 @@ how_to_implement = none {% endif %} annotations = {{ detection.mappings | tojson }} known_false_positives = {{ detection.known_false_positives }} -providing_technologies = {{ detection.providing_technologies }} +providing_technologies = {{ detection.providing_technologies | tojson }} {% endif %} {% endfor %} diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index ebbdd45739..57f90c9631 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -93,11 +93,13 @@ class SecurityContentDetectionBuilder(DetectionBuilder): if self.security_content_obj: # if self.security_content_obj.tags.supported_tas: if 'Endpoint' in self.security_content_obj.datamodel: - self.security_content_obj.providing_technologies = "['Sysmon', 'Microsoft Windows','Carbon Black Response','CrowdStrike Falcon', 'Symantec Endpoint Protection']" + self.security_content_obj.providing_technologies = ["Sysmon", "Microsoft Windows","Carbon Black Response","CrowdStrike Falcon", "Symantec Endpoint Protection"] if "`cloudtrail`" in str(self.security_content_obj.search): - self.security_content_obj.providing_technologies = "['Amazon Web Services - Cloudtrail']" + self.security_content_obj.providing_technologies = ["Amazon Web Services - Cloudtrail"] if '`wineventlog_security`' in self.security_content_obj.search or '`powershell`' in self.security_content_obj.search: - self.security_content_obj.providing_technologies = "['Microsoft Windows']" + self.security_content_obj.providing_technologies = ["Microsoft Windows"] + + def addNesFields(self) -> None: From 047eafe9fa6ed3ffd27d684e756333a356900cc6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Jun 2022 16:18:00 -0700 Subject: [PATCH 6/8] pytest --- .../adapter/data/default_reference/analyticstories.conf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf index 5d1de1ec59..a5eee42b17 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf @@ -15,7 +15,8 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]} known_false_positives = None identified. -providing_technologies = [] +providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] + [savedsearch://ESCU - Detect new user AWS Console Login - Rule] type = detection @@ -25,7 +26,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. -providing_technologies = [] +providing_technologies = ["Amazon Web Services - Cloudtrail"] ### END DETECTIONS ### From 4d613e3aad57daadbc03c1da2194da2bf0a40b6e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Jun 2022 16:18:47 -0700 Subject: [PATCH 7/8] default --- .../tests/adapter/data/default/analyticstories.conf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf index 5d1de1ec59..a5eee42b17 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf @@ -15,7 +15,8 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]} known_false_positives = None identified. -providing_technologies = [] +providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] + [savedsearch://ESCU - Detect new user AWS Console Login - Rule] type = detection @@ -25,7 +26,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. -providing_technologies = [] +providing_technologies = ["Amazon Web Services - Cloudtrail"] ### END DETECTIONS ### From 14032234869ae323546823b2f847b9b99baa6627 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 28 Jun 2022 20:12:46 +0200 Subject: [PATCH 8/8] small bug fix --- .../tests/adapter/data/default/analyticstories.conf | 1 - .../tests/adapter/data/default/savedsearches.conf | 4 ++-- .../tests/adapter/data/default_reference/analyticstories.conf | 1 - .../tests/adapter/data/default_reference/savedsearches.conf | 4 ++-- 4 files changed, 4 insertions(+), 6 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf index a5eee42b17..3a0f1f3865 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf @@ -17,7 +17,6 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act known_false_positives = None identified. providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] - [savedsearch://ESCU - Detect new user AWS Console Login - Rule] type = detection asset_type = AWS Instance diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf index 179cb469ec..b4c7576fb4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf @@ -21,7 +21,7 @@ action.escu.confidence = high action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] +action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. @@ -67,7 +67,7 @@ action.escu.confidence = high action.escu.full_search_name = ESCU - Detect new user AWS Console Login - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] +action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["Suspicious AWS Login Activities"] action.risk = 1 action.risk.param._risk_message = tbd diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf index a5eee42b17..3a0f1f3865 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf @@ -17,7 +17,6 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act known_false_positives = None identified. providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] - [savedsearch://ESCU - Detect new user AWS Console Login - Rule] type = detection asset_type = AWS Instance diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf index 179cb469ec..b4c7576fb4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf @@ -21,7 +21,7 @@ action.escu.confidence = high action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] +action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. @@ -67,7 +67,7 @@ action.escu.confidence = high action.escu.full_search_name = ESCU - Detect new user AWS Console Login - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] +action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"] action.escu.analytic_story = ["Suspicious AWS Login Activities"] action.risk = 1 action.risk.param._risk_message = tbd