From 812cc46e65829dc685ca192ba1ea71c17e2970cd Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Mon, 21 Jun 2021 13:21:30 -0500 Subject: [PATCH 1/3] Fix for TR-763 --- .../ssa___system_process_running_unexpected_location.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index deb0c58af0..ca13c9e39c 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | - union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path + union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" AND process_path NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' From 535875fe09433ac81d4378673f6c9023a715cb16 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Tue, 22 Jun 2021 10:36:06 -0500 Subject: [PATCH 2/3] Fixed bug as ID'd by TR-724 --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 33377bd2ce..8fb17415ed 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -25,7 +25,7 @@ search: '| from read_ssa_enriched_events() | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", - parent_process_name]) | into write_ssa_detected_events();' + parent_process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately From 1dc74c1b93b9719a403144214d4cc7bca163c459 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Tue, 22 Jun 2021 11:08:10 -0500 Subject: [PATCH 3/3] Really actually fixed the merge conflict --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index d5cf0719a7..8fb17415ed 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -24,11 +24,7 @@ search: '| from read_ssa_enriched_events() OR field0="java.exe" OR field0="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, -<<<<<<< HEAD dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", -======= - dest_user_id), body=create_map([ "process_name", process_name, "parent_process", ->>>>>>> develop parent_process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP.