From ac3bed4a4b3e44fe8c97fc9cfb052de6b3e8c96b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 5 Apr 2022 13:32:31 -0700 Subject: [PATCH 1/6] str for nes fields --- .../domain/entities/deployment_notable.py | 2 +- .../builder/security_content_detection_builder.py | 9 +++++---- deployments/ESCU/00_default_correlation.yml | 5 +---- deployments/ESCU/00_default_ttp.yml | 7 ++----- 4 files changed, 9 insertions(+), 14 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py b/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py index b72ff166e0..5f50baaf0e 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py @@ -5,4 +5,4 @@ from pydantic import BaseModel, validator, ValidationError class DeploymentNotable(BaseModel): rule_description: str rule_title: str - nes_fields: list \ No newline at end of file + nes_fields: str \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 95465afeff..5871fcd740 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -95,11 +95,12 @@ class SecurityContentDetectionBuilder(DetectionBuilder): nes_fields_matches = [] if self.security_content_obj.deployment: if self.security_content_obj.deployment.notable: - for nes_field in self.security_content_obj.deployment.notable.nes_fields: - if (self.security_content_obj.search.find(nes_field + ' ') != -1): - nes_fields_matches.append(nes_field) + # print (self.security_content_obj.deployment.notable.nes_fields) + # for nes_field in self.security_content_obj.deployment.notable.nes_fields: + # # if (self.security_content_obj.search.find(nes_field + ' ') != -1): + # nes_fields_matches.append(nes_field) - self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches + self.security_content_obj.deployment.notable.nes_fields = self.security_content_obj.deployment.notable.nes_fields def addMappings(self) -> None: diff --git a/deployments/ESCU/00_default_correlation.yml b/deployments/ESCU/00_default_correlation.yml index 36531a0e7a..20506fd652 100644 --- a/deployments/ESCU/00_default_correlation.yml +++ b/deployments/ESCU/00_default_correlation.yml @@ -13,10 +13,7 @@ alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: - - user - - dest - - src + nes_fields: 'user' tags: type: 'Correlation' product: ESCU diff --git a/deployments/ESCU/00_default_ttp.yml b/deployments/ESCU/00_default_ttp.yml index 94d690b648..1f388efa41 100644 --- a/deployments/ESCU/00_default_ttp.yml +++ b/deployments/ESCU/00_default_ttp.yml @@ -6,17 +6,14 @@ description: This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events. scheduling: cron_schedule: 0 * * * * - earliest_time: -70m@m + earliest_time: -76m@m latest_time: -10m@m schedule_window: auto alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: - - user - - dest - - src + nes_fields: 'user' rba: enabled: 'true' tags: From df65357cf56c4874955f7c4fcf917d8a75fac4b7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 5 Apr 2022 13:48:37 -0700 Subject: [PATCH 2/6] destt in str --- deployments/ESCU/00_default_correlation.yml | 2 +- deployments/ESCU/00_default_ttp.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deployments/ESCU/00_default_correlation.yml b/deployments/ESCU/00_default_correlation.yml index 20506fd652..df6a7a3ddd 100644 --- a/deployments/ESCU/00_default_correlation.yml +++ b/deployments/ESCU/00_default_correlation.yml @@ -13,7 +13,7 @@ alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: 'user' + nes_fields: 'user, dest' tags: type: 'Correlation' product: ESCU diff --git a/deployments/ESCU/00_default_ttp.yml b/deployments/ESCU/00_default_ttp.yml index 1f388efa41..78e3179155 100644 --- a/deployments/ESCU/00_default_ttp.yml +++ b/deployments/ESCU/00_default_ttp.yml @@ -6,14 +6,14 @@ description: This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events. scheduling: cron_schedule: 0 * * * * - earliest_time: -76m@m + earliest_time: -70m@m latest_time: -10m@m schedule_window: auto alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: 'user' + nes_fields: 'user, dest' rba: enabled: 'true' tags: From cc29450acbf149e947bc51faca7406c329128f17 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 11 Apr 2022 09:29:43 -0700 Subject: [PATCH 3/6] return value --- .../builder/security_content_detection_builder.py | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 5871fcd740..c99ead703e 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -92,15 +92,9 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def addNesFields(self) -> None: if self.security_content_obj: - nes_fields_matches = [] if self.security_content_obj.deployment: if self.security_content_obj.deployment.notable: - # print (self.security_content_obj.deployment.notable.nes_fields) - # for nes_field in self.security_content_obj.deployment.notable.nes_fields: - # # if (self.security_content_obj.search.find(nes_field + ' ') != -1): - # nes_fields_matches.append(nes_field) - - self.security_content_obj.deployment.notable.nes_fields = self.security_content_obj.deployment.notable.nes_fields + return self.security_content_obj.deployment.notable.nes_fields def addMappings(self) -> None: @@ -238,4 +232,3 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def getObject(self) -> SecurityContentObject: return self.security_content_obj - From 8d8998d243fc1972aef3ed31ab1b2840d0967669 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Apr 2022 11:03:52 -0700 Subject: [PATCH 4/6] adding nes to detection object --- .../contentctl_core/domain/entities/deployment_notable.py | 2 +- .../contentctl_core/domain/entities/detection.py | 1 + .../adapter/templates/savedsearches_detections.j2 | 4 ++-- .../builder/security_content_detection_builder.py | 4 +++- deployments/ESCU/00_default_correlation.yml | 4 +++- deployments/ESCU/00_default_ttp.yml | 4 +++- 6 files changed, 13 insertions(+), 6 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py b/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py index 5f50baaf0e..b72ff166e0 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/deployment_notable.py @@ -5,4 +5,4 @@ from pydantic import BaseModel, validator, ValidationError class DeploymentNotable(BaseModel): rule_description: str rule_title: str - nes_fields: str \ No newline at end of file + nes_fields: list \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 0e9c81dc21..d2bb95035f 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -51,6 +51,7 @@ class Detection(BaseModel, SecurityContentObject): splunk_app_enrichment: list = None file_path: str = None source: str = None + nes_fields: str = None # @validator('name') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index 7e9d478a2c..c4155ab1a3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -64,8 +64,8 @@ schedule_window = {{ detection.deployment.scheduling.schedule_window }} {% if detection.deployment is defined %} {% if detection.deployment.notable.rule_title is defined %} action.notable = 1 -{% if detection.deployment.notable.nes_fields is defined %} -action.notable.param.nes_fields = {{ detection.deployment.notable.nes_fields }} +{% if detection.nes_fields is defined %} +action.notable.param.nes_fields = {{ detection.nes_fields }} {% endif %} action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }} action.notable.param.rule_title = {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }} diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index c99ead703e..072facd9c0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -94,7 +94,9 @@ class SecurityContentDetectionBuilder(DetectionBuilder): if self.security_content_obj: if self.security_content_obj.deployment: if self.security_content_obj.deployment.notable: - return self.security_content_obj.deployment.notable.nes_fields + nes_fields = ",".join(list(self.security_content_obj.deployment.notable.nes_fields)) + self.security_content_obj.nes_fields = nes_fields + def addMappings(self) -> None: diff --git a/deployments/ESCU/00_default_correlation.yml b/deployments/ESCU/00_default_correlation.yml index df6a7a3ddd..b1cca041a6 100644 --- a/deployments/ESCU/00_default_correlation.yml +++ b/deployments/ESCU/00_default_correlation.yml @@ -13,7 +13,9 @@ alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: 'user, dest' + nes_fields: + - user + - dest tags: type: 'Correlation' product: ESCU diff --git a/deployments/ESCU/00_default_ttp.yml b/deployments/ESCU/00_default_ttp.yml index 78e3179155..513bffeba6 100644 --- a/deployments/ESCU/00_default_ttp.yml +++ b/deployments/ESCU/00_default_ttp.yml @@ -13,7 +13,9 @@ alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: 'user, dest' + nes_fields: + - user + - dest rba: enabled: 'true' tags: From e171e3c6ea510942362284246c8b3688532eeaf8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Apr 2022 17:40:11 -0700 Subject: [PATCH 5/6] test updates --- .../test_data/deployment/ESCU/00_default_correlation.yml | 1 - .../tests/builder/test_data/deployment/ESCU/00_default_ttp.yml | 1 - .../tests/builder/test_security_content_director.py | 2 +- 3 files changed, 1 insertion(+), 3 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml index 36531a0e7a..2dea0903bb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml @@ -16,7 +16,6 @@ alert_action: nes_fields: - user - dest - - src tags: type: 'Correlation' product: ESCU diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml index 94d690b648..c7608299a7 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml @@ -16,7 +16,6 @@ alert_action: nes_fields: - user - dest - - src rba: enabled: 'true' tags: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py index 60a40bed79..165cd23fc3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py @@ -164,7 +164,7 @@ def test_construct_detections(): assert detection.name == "Attempted Credential Dump From Registry via Reg exe" assert detection.author == "Patrick Bareiss, Splunk" assert detection.deployment.name == "ESCU Default Configuration TTP" - assert detection.deployment.notable.nes_fields == ['user', 'dest'] + assert detection.nes_fields == user, dest assert detection.annotations == valid_annotations assert detection.risk == valid_risk assert detection.playbooks[0].name == "Ransomware Investigate and Contain" From 876071e45d46b449eeb75349e7bb7645166495a6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 14 Apr 2022 12:24:13 +0200 Subject: [PATCH 6/6] fixed some small issues --- .../tests/adapter/data/default/savedsearches.conf | 4 ++-- .../tests/adapter/data/default_reference/savedsearches.conf | 4 ++-- .../tests/builder/test_security_content_director.py | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf index f96947a1ae..179cb469ec 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf @@ -36,7 +36,7 @@ action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe action.notable.param.security_domain = endpoint @@ -82,7 +82,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. action.notable.param.rule_title = Detect new user AWS Console Login action.notable.param.security_domain = network diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf index f96947a1ae..179cb469ec 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf @@ -36,7 +36,7 @@ action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe action.notable.param.security_domain = endpoint @@ -82,7 +82,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. action.notable.param.rule_title = Detect new user AWS Console Login action.notable.param.security_domain = network diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py index 165cd23fc3..82e22c6d78 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py @@ -164,7 +164,7 @@ def test_construct_detections(): assert detection.name == "Attempted Credential Dump From Registry via Reg exe" assert detection.author == "Patrick Bareiss, Splunk" assert detection.deployment.name == "ESCU Default Configuration TTP" - assert detection.nes_fields == user, dest + assert detection.nes_fields == "user,dest" assert detection.annotations == valid_annotations assert detection.risk == valid_risk assert detection.playbooks[0].name == "Ransomware Investigate and Contain"