From 83e9bad107113e37801520efe91ae232cd43fb26 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 7 Sep 2022 18:49:22 -0400 Subject: [PATCH 1/4] working on feedback --- detections/endpoint/living_off_the_land.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 6f2cb9d35d..9ade90d0ee 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -7,13 +7,12 @@ type: Correlation datamodel: - Risk description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source - | `drop_dm_object_name(All_Risk)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | stats values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object - | where distinct_detection_name >= 2 - | `living_off_the_land_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic +| `drop_dm_object_name(All_Risk)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| where source_count >= 2 +| `living_off_the_land_filter`' how_to_implement: To implement this correlation search a user needs to enable all detections in the Living Off The Land Analytic Story and confirm it is generating risk events. A simple search `index=risk analyticstories="Living Off The Land"` should contain From e1a522e4abd47d18ecde9057ceaa47fe15e11f96 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 9 Sep 2022 13:21:57 -0600 Subject: [PATCH 2/4] Update living_off_the_land.yml --- detections/endpoint/living_off_the_land.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 9ade90d0ee..458538466f 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -1,7 +1,7 @@ name: Living Off The Land id: 1be30d80-3a39-4df9-9102-64a467b24abc -version: 1 -date: '2022-07-08' +version: 2 +date: '2022-09-09' author: Michael Haag, Splunk type: Correlation datamodel: From e027f13add2ffa3e3535f18368b3b17e7447174e Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 14 Sep 2022 18:33:15 -0400 Subject: [PATCH 3/4] removing risk objects from correlation searches on savedsearchesconf to avoid circular risk loop --- .../adapter/templates/savedsearches_detections.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index ae77fbd81c..2500889ae7 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -38,7 +38,7 @@ action.escu.providing_technologies = [] {% endif %} {% if detection.tags.analytic_story is defined %} action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} -{% if detection.tags.risk_score is defined %} +{% if detection.tags.risk_score is defined and detection.type | lower != "correlation" %} action.risk = 1 action.risk.param._risk_message = {{ detection.tags.message }} action.risk.param._risk = {{ detection.risk | tojson }} From 50a2d18163e32515c25ec63c3d9be548cee457c5 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 14 Sep 2022 19:20:57 -0400 Subject: [PATCH 4/4] fixing missing test --- .../adapter/templates/savedsearches_detections.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index 2500889ae7..c984b38532 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -54,6 +54,8 @@ dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }} action.correlationsearch.enabled = 1 {% if detection.deprecated %} action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule +{% elif detection.type | lower == "correlation" %} +action.correlationsearch.label = ESCU - RIR - {{ detection.name }} - Rule {% else %} action.correlationsearch.label = ESCU - {{ detection.name }} - Rule {% endif %}