formatting

detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml

@@ -8,8 +8,7 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
 type: SSA
 references: ['https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf']
 author: Jose Hernandez, Splunk
-search: '
-| from read_ssa_enriched_events()
+search: '| from read_ssa_enriched_events()
 | select from_json_object(value) as input_event
 | eval tenant=ucast(map_get(input_event, "_tenant"), "string", null),
 machine=ucast(map_get(input_event, "dest_device_id"), "string", null),
@@ -22,8 +21,7 @@ AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true
        end_time = timestamp,
        entities = mvappend(machine),
        body = "TBD"
-| into write_ssa_detected_events();
-'
+| into write_ssa_detected_events();'
 known_false_positives: None identified.
 tags:
   analytics_story:

detections/detect_phishing_content___ssa.yml

@@ -19,8 +19,7 @@ how_to_implement: Events are fed to DSP contains at least email's sender, subjec
 references: [ ]
 type: SSA
 author: Xiao Lin, Splunk
-search: '
-| from read_ssa_enriched_events()
+search: '| from read_ssa_enriched_events()
 | source_type="email"
 | eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn),
 eventLine=concat(ucast(map_get(jsonMap, "From"), "string", null), " ", ucast(map_get(jsonMap, "Subject"), "string", null), " ", ucast(map_get(jsonMap, "Content"), "string", null), "                                                                                                                                ")
@@ -30,8 +29,8 @@ mapC = {" ":32,"!":33,"\"":34,"#":35,"$":36,"%":37,"&":38,"`":39,"(":40,")":41,"
 | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v2" path="s3://smle-experiments/models/phishing_email"
 | where mvindex(`dense/Sigmoid:0`, 0) > 0.5
 | select body, host, timestamp, source_type, source, cast(mvindex(`dense/Sigmoid:0`, 0), "float") AS probability
-| into write_ssa_detected_events();
-'
+| eval entities = mvappend(host)
+| into write_ssa_detected_events();'
 known_false_positives: Because of imbalance of anomaly data in training, the model will less likely report false
   positive. Instead, the model is more prone to false negative. Current best recall score is ~85%
 tags:

detections/first_time_seen_cmd_line___ssa.yml

@@ -9,8 +9,7 @@ how_to_implement: "You must be ingesting sysmon logs.
 This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP." 
 author: Ignacio Bermudez Corrales, Splunk
 type: SSA
-search: '
-| from read_ssa_enriched_events()
+search: '| from read_ssa_enriched_events()
 | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
 | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
        dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
@@ -24,8 +23,7 @@ search: '
        end_time = timestamp,
        entities = mvappend(dest_device_id, dest_user_id),
        body = "TBD"
-| into write_ssa_detected_events();
-'
+| into write_ssa_detected_events();'
 eli5: "The subsearch returns all events where `cmd.exe` was used with a `/c` parameter
   in the command-line arguments to execute other commands/programs. It appends the
   historical data to those results in the lookup file. Next, it recalculates the `firstTime`

detections/prohibited_apps_spawning_cmdprompt___ssa.yml

@@ -9,8 +9,7 @@ how_to_implement: "You must be ingesting sysmon logs.
 This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP."
 author: Ignacio Bermudez Corrales, Splunk
 type: SSA
-search: '
-| from read_ssa_enriched_events()
+search: '| from read_ssa_enriched_events()
 
 | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
 | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -39,8 +38,7 @@ dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
 end_time=timestamp,
 entities=mvappend(dest_device_id, dest_user_id),
 body="TBD"
-| into write_ssa_detected_events();
-'
+| into write_ssa_detected_events();'
 eli5: "Obtaining access to the Command-Line Interface (CLI) is typically a primary
          attacker goal. Once an attacker has obtained the ability to execute code on a target
          system, they will often further manipulate the system via commands passed to the

detections/rare_parent_process_relationship_lolbas___ssa.yaml

@@ -11,8 +11,7 @@ how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 references: []
 type: SSA
 author: Ignacio Bermudez Corrales, Splunk
-search: '
-| from read_ssa_enriched_events()
+search: '| from read_ssa_enriched_events()
 | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
 | eval parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)),
 process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),

detections/unusually_long_command_line___ssa.yml

@@ -23,8 +23,7 @@ dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
 end_time = timestamp,
 entities = mvappend(dest_device_id, dest_user_id),
 body = "TBD"
-| into write_ssa_detected_events();
-'
+| into write_ssa_detected_events();'
 known_false_positives: Some legitimate applications use long command lines for installs
   or updates. You should review identified command lines for legitimacy.
   At the beginning of this search `adaptive_threshold` needs time to learn the baseline.