From ac129ddf7bceb262c58ef99ccdf39bfc42004cfb Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 24 Jul 2023 18:45:19 -0700 Subject: [PATCH] Fixed name of one detection. Fixed misnamed macros in a handful of detections. Updated test information for all detections since they originally pointed to a single log file with multiple sources in it, leading to it being parsed incorrectly. --- ...l_chain.yml => powershell_script_block_with_url_chain.yml} | 4 ++-- .../endpoint/powershell_webrequest_using_memory_stream.yml | 4 ++-- ...suspicious_process_executed_from_container_file_filter.yml | 4 ++-- detections/endpoint/windows_registry_payload_injection.yml | 4 ++-- .../endpoint/windows_scheduled_task_service_spawned_shell.yml | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) rename detections/endpoint/{powershell_powershell_script_block_with_url_chain.yml => powershell_script_block_with_url_chain.yml} (96%) diff --git a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml similarity index 96% rename from detections/endpoint/powershell_powershell_script_block_with_url_chain.yml rename to detections/endpoint/powershell_script_block_with_url_chain.yml index 527f228577..8c40215cdd 100644 --- a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_script_block_with_url_chain.yml @@ -69,6 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 80efc992b6..41b2cadc90 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -16,7 +16,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText IN ("*system.net.webclient | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `powershell_webrequest_using_memorystream_filter`' +| `powershell_webrequest_using_memory_stream_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -64,6 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml index d4d1154b55..2afd72ceac 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml @@ -58,6 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml index 35746f8e48..15c7f08022 100644 --- a/detections/endpoint/windows_registry_payload_injection.yml +++ b/detections/endpoint/windows_registry_payload_injection.yml @@ -69,6 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 8915c89e14..1b30649708 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -65,6 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: xmlwineventlog \ No newline at end of file