Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-11-01 07:20:37 -07:00
parent 575ca0901f 6a72a55341
commit ba7d2ea291
58 changed files with 62 additions and 1 deletions
@@ -38,6 +38,7 @@ class DetectionTags(BaseModel):
    observable_str: str = None
    kill_chain_phases_id: list = None
    research_site_url: str = None
+    event_schema: str = None


    @validator('cis20')
@@ -35,6 +35,9 @@ class ObjToYmlAdapter(Adapter):
            research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/"
            obj.tags.research_site_url = research_site_url

+            # add ocsf schema tag
+            obj.tags.event_schema = 'cim'
+
            body = FindingReportObject.writeFindingReport(obj)

            # remove unncessary fields
@@ -60,7 +63,8 @@ class ObjToYmlAdapter(Adapter):
                                "risk_score": True,
                                "security_domain": True,
                                "required_fields": True,
-                                "research_site_url": True
+                                "research_site_url": True,
+                                "event_schema": True
                            },
                        "test": 
                            {
@@ -54,6 +54,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/
+  event_schema: cim
 test:
  name: Anomalous usage of Archive Tools Unit Test
  tests:
@@ -48,6 +48,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/
+  event_schema: cim
 test:
  name: Anomalous usage of Archive Tools Unit Test
  tests:
@@ -56,6 +56,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/
+  event_schema: cim
 test:
  name: Attempt To Delete Services Unit Test
  tests:
@@ -55,6 +55,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/
+  event_schema: cim
 test:
  name: Attempt To Disable Services Unit Test
  tests:
@@ -51,6 +51,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/
+  event_schema: cim
 test:
  name: Attempted Credential Dump From Registry via Reg exe Unit Test
  tests:
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/
+  event_schema: cim
 test:
  name: BCDEdit Failure Recovery Modification Unit Test
  tests:
@@ -55,6 +55,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/
+  event_schema: cim
 test:
  name: Clear Unallocated Sector Using Cipher - SSA Unit test
  tests:
@@ -54,6 +54,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/
+  event_schema: cim
 test:
  name: Delete A Net User Unit Test
  tests:
@@ -52,6 +52,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/
+  event_schema: cim
 test:
  name: Deny Permission using Cacls Utility Unit Test
  tests:
@@ -54,6 +54,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/
+  event_schema: cim
 test:
  name: Detect Prohibited Applications Spawning cmd exe Unit Test
  tests:
@@ -59,6 +59,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/
+  event_schema: cim
 test:
  name: Detect RClone Command-Line Usage Unit Test
  tests:
@@ -55,6 +55,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/
+  event_schema: cim
 test:
  name: Disable Net User Account Unit Test
  tests:
@@ -55,6 +55,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/
+  event_schema: cim
 test:
  name: DNS Exfiltration Using Nslookup App Unit Test
  tests:
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/
+  event_schema: cim
 test:
  name: Fsutil Zeroing File Unit Test
  tests:
@@ -52,6 +52,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/
+  event_schema: cim
 test:
  name: Grant Permission Using Cacls Utility Unit Test
  tests:
@@ -49,6 +49,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/
+  event_schema: cim
 test:
  name: Hiding Files And Directories With Attrib exe - SSA Unit test
  tests:
@@ -55,6 +55,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/
+  event_schema: cim
 test:
  name: Modify ACLs Permission Of Files Or Folders Unit Test
  tests:
@@ -54,6 +54,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/
+  event_schema: cim
 test:
  name: Resize Shadowstorage Volume Unit Test
  tests:
@@ -64,6 +64,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/
+  event_schema: cim
 test:
  name: Sdelete Application Execution Unit Test
  tests:
@@ -250,6 +250,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/
+  event_schema: cim
 test:
  name: System Process Running from Unexpected Location Unit Test
  tests:
@@ -52,6 +52,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/
+  event_schema: cim
 test:
  name: WBAdmin Delete System Backups Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/
+  event_schema: cim
 test:
  name: WevtUtil Usage To Clear Logs Unit Test
  tests:
@@ -54,6 +54,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/
+  event_schema: cim
 test:
  name: Wevtutil Usage To Disable Logs Unit Test
  tests:
@@ -59,6 +59,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/
+  event_schema: cim
 test:
  name: Windows Bits Job Persistence Unit Test
  tests:
@@ -66,6 +66,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/
+  event_schema: cim
 test:
  name: Windows Bitsadmin Download File Unit Test
  tests:
@@ -60,6 +60,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/
+  event_schema: cim
 test:
  name: Windows CertUtil Decode File Unit Test
  tests:
@@ -57,6 +57,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/
+  event_schema: cim
 test:
  name: Windows CertUtil URLCache Download Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/
+  event_schema: cim
 test:
  name: Windows CertUtil VerifyCtl Download  Unit Test
  tests:
@@ -67,6 +67,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/
+  event_schema: cim
 test:
  name: Windows Curl Upload to Remote Destination Unit Test
  tests:
@@ -46,6 +46,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/
+  event_schema: cim
 test:
  name: Windows Defender Tools in Non Standard Path Unit Test
  tests:
@@ -51,6 +51,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/
+  event_schema: cim
 test:
  name: BA Windows Diskshadow Proxy Execution Unit Test
  tests:
@@ -78,6 +78,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/
+  event_schema: cim
 test:
  name: Windows DotNet Binary in Non Standard Path Unit Test
  tests:
@@ -60,6 +60,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/
+  event_schema: cim
 test:
  name: Windows Eventvwr UAC Bypass Unit Test
  tests:
@@ -62,6 +62,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/
+  event_schema: cim
 test:
  name: Windows Execute Arbitrary Commands with MSDT Unit Test
  tests:
@@ -56,6 +56,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/
+  event_schema: cim
 test:
  name: Windows Ingress Tool Transfer Using Explorer Unit Test
  tests:
@@ -88,6 +88,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/
+  event_schema: cim
 test:
  name: Windows LOLBin Binary in Non Standard Path Unit Test
  tests:
@@ -57,6 +57,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/
+  event_schema: cim
 test:
  name: Windows MSHTA Child Process Unit Test
  tests:
@@ -59,6 +59,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/
+  event_schema: cim
 test:
  name: Windows MSHTA Command-Line URL Unit Test
  tests:
@@ -57,6 +57,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/
+  event_schema: cim
 test:
  name: Windows MSHTA Inline HTA Execution Unit Test
  tests:
@@ -56,6 +56,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/
+  event_schema: cim
 test:
  name: Windows Odbcconf Load Response File Unit Test
  tests:
@@ -61,6 +61,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/
+  event_schema: cim
 test:
  name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/
+  event_schema: cim
 test:
  name: Windows OS Credential Dumping with Procdump Unit Test
  tests:
@@ -65,6 +65,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/
+  event_schema: cim
 test:
  name: Windows Powershell Connect to Internet With Hidden Window Unit Test
  tests:
@@ -59,6 +59,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/
+  event_schema: cim
 test:
  name: Windows Powershell DownloadFile Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/
+  event_schema: cim
 test:
  name: Windows PowerShell Start-BitsTransfer Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/
+  event_schema: cim
 test:
  name: Windows Rasautou DLL Execution Unit Test
  tests:
@@ -46,6 +46,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/
+  event_schema: cim
 test:
  name: Windows Rundll32 Comsvcs Memory Dump Unit Test
  tests:
@@ -60,6 +60,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/
+  event_schema: cim
 test:
  name: Windows Rundll32 Inline HTA Execution Unit Test
  tests:
@@ -57,6 +57,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/
+  event_schema: cim
 test:
  name: Windows Script Host Spawn MSBuild Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/
+  event_schema: cim
 test:
  name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
  tests:
@@ -65,6 +65,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/
+  event_schema: cim
 test:
  name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
    Unit Test
@@ -68,6 +68,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/
+  event_schema: cim
 test:
  name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
    Handlers Unit Test
@@ -48,6 +48,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/
+  event_schema: cim
 test:
  name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
  tests:
@@ -48,6 +48,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/
+  event_schema: cim
 test:
  name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
  tests:
@@ -48,6 +48,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/
+  event_schema: cim
 test:
  name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
  tests:
@@ -58,6 +58,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/
+  event_schema: cim
 test:
  name: Windows WMIPrvse Spawn MSBuild Unit Test
  tests: