From d3fe59a15c7ef826b0168b269fef78f9c0a77d8e Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 12 Oct 2022 18:50:39 -0400 Subject: [PATCH 1/3] adding data_schema tag --- .../contentctl_core/domain/entities/detection_tags.py | 1 + .../contentctl_infrastructure/adapter/obj_to_yml_adapter.py | 6 +++++- dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + dist/ssa/srs/ssa___attempt_to_delete_services.yml | 1 + dist/ssa/srs/ssa___attempt_to_disable_services.yml | 1 + ..._attempted_credential_dump_from_registry_via_reg_exe.yml | 1 + .../ssa/srs/ssa___bcdedit_failure_recovery_modification.yml | 1 + .../srs/ssa___clear_unallocated_sector_using_cipher_app.yml | 1 + dist/ssa/srs/ssa___delete_a_net_user.yml | 1 + dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml | 1 + ...sa___detect_prohibited_applications_spawning_cmd_exe.yml | 1 + dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml | 1 + dist/ssa/srs/ssa___disable_net_user_account.yml | 1 + dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml | 1 + dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 1 + dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml | 1 + .../ssa___hiding_files_and_directories_with_attrib_exe.yml | 1 + .../ssa___modify_acls_permission_of_files_or_folders.yml | 1 + dist/ssa/srs/ssa___resize_shadowstorage_volume.yml | 1 + dist/ssa/srs/ssa___sdelete_application_execution.yml | 1 + ...sa___system_process_running_from_unexpected_location.yml | 1 + dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 1 + dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml | 2 ++ dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml | 1 + dist/ssa/srs/ssa___windows_bits_job_persistence.yml | 1 + dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml | 1 + dist/ssa/srs/ssa___windows_certutil_decode_file.yml | 1 + dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml | 1 + dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml | 1 + .../srs/ssa___windows_curl_upload_to_remote_destination.yml | 1 + .../ssa___windows_defender_tools_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml | 1 + .../ssa___windows_dotnet_binary_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml | 1 + .../ssa___windows_execute_arbitrary_commands_with_msdt.yml | 1 + .../ssa___windows_ingress_tool_transfer_using_explorer.yml | 1 + .../ssa___windows_lolbin_binary_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_mshta_child_process.yml | 1 + dist/ssa/srs/ssa___windows_mshta_command_line_url.yml | 1 + dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml | 1 + dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml | 1 + ...dows_os_credential_dumping_with_ntdsutil_export_ntds.yml | 1 + .../ssa___windows_os_credential_dumping_with_procdump.yml | 1 + ...ws_powershell_connect_to_internet_with_hidden_window.yml | 1 + dist/ssa/srs/ssa___windows_powershell_downloadfile.yml | 1 + .../ssa/srs/ssa___windows_powershell_start_bitstransfer.yml | 1 + dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml | 1 + dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml | 1 + .../ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml | 1 + dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml | 1 + ..._binary_proxy_execution_compiled_html_file_decompile.yml | 1 + ...oxy_execution_compiled_html_file_url_in_command_line.yml | 1 + ...n_compiled_html_file_using_infotech_storage_handlers.yml | 1 + ...tem_binary_proxy_execution_msiexec_dllregisterserver.yml | 1 + ...ystem_binary_proxy_execution_msiexec_remote_download.yml | 1 + ...system_binary_proxy_execution_msiexec_unregister_dll.yml | 1 + dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 1 + 57 files changed, 62 insertions(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 4afa6702cc..602d8184bb 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -38,6 +38,7 @@ class DetectionTags(BaseModel): observable_str: str = None kill_chain_phases_id: list = None research_site_url: str = None + data_schema: str = None @validator('cis20') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index bda2fb25d6..0588ed3fbc 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -35,6 +35,9 @@ class ObjToYmlAdapter(Adapter): research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/" obj.tags.research_site_url = research_site_url + # add ocsf schema tag + obj.tags.data_schema = 'ocsf-1' + body = FindingReportObject.writeFindingReport(obj) # remove unncessary fields @@ -60,7 +63,8 @@ class ObjToYmlAdapter(Adapter): "risk_score": True, "security_domain": True, "required_fields": True, - "research_site_url": True + "research_site_url": True, + "data_schema": True }, "test": { diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index ef21f81a22..0d2924c670 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ + data_schema: ocsf-1 test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index b97e58523b..0d1113abd7 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -56,6 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ + data_schema: ocsf-1 test: name: Attempt To Delete Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 91351c5140..be0953e4dd 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ + data_schema: ocsf-1 test: name: Attempt To Disable Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 55124fcc46..5b912cb735 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -51,6 +51,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ + data_schema: ocsf-1 test: name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 2d5a4daffb..89781243d1 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -49,6 +49,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ + data_schema: ocsf-1 test: name: BCDEdit Failure Recovery Modification Unit Test tests: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 723fb37720..c49d02891a 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ + data_schema: ocsf-1 test: name: Clear Unallocated Sector Using Cipher - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 17c5a937c6..237555509e 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ + data_schema: ocsf-1 test: name: Delete A Net User Unit Test tests: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 7b1b3db5de..4018667b00 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -52,6 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ + data_schema: ocsf-1 test: name: Deny Permission using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 55ea07ea07..2c583e75b9 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ + data_schema: ocsf-1 test: name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 7baacb920d..7051ed7022 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ + data_schema: ocsf-1 test: name: Detect RClone Command-Line Usage Unit Test tests: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 90fcf77928..ff3659693f 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ + data_schema: ocsf-1 test: name: Disable Net User Account Unit Test tests: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 98a1f181e7..8fb8a33a3f 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ + data_schema: ocsf-1 test: name: DNS Exfiltration Using Nslookup App Unit Test tests: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 24876e8841..43159a7ff1 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -49,6 +49,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ + data_schema: ocsf-1 test: name: Fsutil Zeroing File Unit Test tests: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index bc15802fc1..c3ce56a44e 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -52,6 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ + data_schema: ocsf-1 test: name: Grant Permission Using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 44a0c11d93..b86e506ab0 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -49,6 +49,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ + data_schema: ocsf-1 test: name: Hiding Files And Directories With Attrib exe - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 7527d8b6fb..51c834744b 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ + data_schema: ocsf-1 test: name: Modify ACLs Permission Of Files Or Folders Unit Test tests: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index e865a128fb..a32162fd81 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ + data_schema: ocsf-1 test: name: Resize Shadowstorage Volume Unit Test tests: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index bd10fa95d5..a2e08db8ae 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -64,6 +64,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ + data_schema: ocsf-1 test: name: Sdelete Application Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index ceaf466082..d8f1ce26d4 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -250,6 +250,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ + data_schema: ocsf-1 test: name: System Process Running from Unexpected Location Unit Test tests: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 6fa1179c6e..e96b78137e 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -52,6 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ + data_schema: ocsf-1 test: name: WBAdmin Delete System Backups Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 93652eed5e..0827c571ee 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -34,6 +34,7 @@ tags: - Ransomware - Clop Ransomware - Insider Threat + - CISA AA22-264A cis20: - CIS 8 - CIS 13 @@ -57,6 +58,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ + data_schema: ocsf-1 test: name: WevtUtil Usage To Clear Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 793f4a5bb2..9183afb2b6 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ + data_schema: ocsf-1 test: name: Wevtutil Usage To Disable Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index abee8d7d9f..0963437242 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ + data_schema: ocsf-1 test: name: Windows Bits Job Persistence Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index c19ba4c5bf..51e083bcaf 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -66,6 +66,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ + data_schema: ocsf-1 test: name: Windows Bitsadmin Download File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index c95b23c276..4782310dd0 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -60,6 +60,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ + data_schema: ocsf-1 test: name: Windows CertUtil Decode File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 1b1445dda9..bc161b4a34 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ + data_schema: ocsf-1 test: name: Windows CertUtil URLCache Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index a2aa277852..878324f592 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ + data_schema: ocsf-1 test: name: Windows CertUtil VerifyCtl Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 54d3163ba8..6c27744308 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -67,6 +67,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ + data_schema: ocsf-1 test: name: Windows Curl Upload to Remote Destination Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 9b2b8918ab..47af958c2a 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -46,6 +46,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ + data_schema: ocsf-1 test: name: Windows Defender Tools in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index e3b3f5e002..9b1294c08b 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -51,6 +51,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ + data_schema: ocsf-1 test: name: BA Windows Diskshadow Proxy Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 0725a19f4f..ac24940a00 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -78,6 +78,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ + data_schema: ocsf-1 test: name: Windows DotNet Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index 2e538f0486..1b33b5761d 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -60,6 +60,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/ + data_schema: ocsf-1 test: name: Windows Eventvwr UAC Bypass Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index ab8dbda383..0a3473abbd 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -62,6 +62,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/ + data_schema: ocsf-1 test: name: Windows Execute Arbitrary Commands with MSDT Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 82711dd489..6db1519f50 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -56,6 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/ + data_schema: ocsf-1 test: name: Windows Ingress Tool Transfer Using Explorer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index f0428a0b28..a4c29ec06d 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -88,6 +88,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ + data_schema: ocsf-1 test: name: Windows LOLBin Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index ad74833f85..abca0bb7a7 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ + data_schema: ocsf-1 test: name: Windows MSHTA Child Process Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index cdf152b32b..7070982712 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ + data_schema: ocsf-1 test: name: Windows MSHTA Command-Line URL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 902ff24976..21702cf6a0 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ + data_schema: ocsf-1 test: name: Windows MSHTA Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index a3f28966b7..a4315cc554 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -56,6 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/ + data_schema: ocsf-1 test: name: Windows Odbcconf Load Response File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 2ee634c347..83ad8aa93c 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -61,6 +61,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/ + data_schema: ocsf-1 test: name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index 5baa10def5..8da5700cdc 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/ + data_schema: ocsf-1 test: name: Windows OS Credential Dumping with Procdump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index b26ef34d3c..45a947cd37 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -65,6 +65,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ + data_schema: ocsf-1 test: name: Windows Powershell Connect to Internet With Hidden Window Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 783ee2a239..7e85d25045 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ + data_schema: ocsf-1 test: name: Windows Powershell DownloadFile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index ac16322b40..5e297e000e 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ + data_schema: ocsf-1 test: name: Windows PowerShell Start-BitsTransfer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 0042ab9b8b..2d7429cb12 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ + data_schema: ocsf-1 test: name: Windows Rasautou DLL Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index dade0a7c34..6dcd53e5b2 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -46,6 +46,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ + data_schema: ocsf-1 test: name: Windows Rundll32 Comsvcs Memory Dump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index cb18a878e5..2900f9c3c3 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -60,6 +60,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ + data_schema: ocsf-1 test: name: Windows Rundll32 Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 07f64c8c90..e76daddfdf 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ + data_schema: ocsf-1 test: name: Windows Script Host Spawn MSBuild Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 6e7e5a60bd..3b1e46e3ec 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/ + data_schema: ocsf-1 test: name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index fa03eca60d..4de9c60cbf 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -65,6 +65,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/ + data_schema: ocsf-1 test: name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line Unit Test diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index a00b77cc59..486f02d97c 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -68,6 +68,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/ + data_schema: ocsf-1 test: name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers Unit Test diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 7d8c7f0b1f..a1109f3ad1 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/ + data_schema: ocsf-1 test: name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 1cb8e6a1f6..4dfb7343ad 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/ + data_schema: ocsf-1 test: name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 488030cdcc..ed5e44a5f3 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/ + data_schema: ocsf-1 test: name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index ca34125c3a..e5f12ca51d 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ + data_schema: ocsf-1 test: name: Windows WMIPrvse Spawn MSBuild Unit Test tests: From 43faff68dac1c148834646c5f556be376d177ffb Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 13 Oct 2022 13:58:10 -0400 Subject: [PATCH 2/3] updated given feedback --- .../contentctl_core/domain/entities/detection_tags.py | 2 +- .../contentctl_infrastructure/adapter/obj_to_yml_adapter.py | 4 ++-- dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 2 +- dist/ssa/srs/ssa___attempt_to_delete_services.yml | 2 +- dist/ssa/srs/ssa___attempt_to_disable_services.yml | 2 +- ...___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml | 2 +- .../srs/ssa___clear_unallocated_sector_using_cipher_app.yml | 2 +- dist/ssa/srs/ssa___delete_a_net_user.yml | 2 +- dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml | 2 +- .../ssa___detect_prohibited_applications_spawning_cmd_exe.yml | 2 +- dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml | 2 +- dist/ssa/srs/ssa___disable_net_user_account.yml | 2 +- dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml | 2 +- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 2 +- dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml | 2 +- .../ssa___hiding_files_and_directories_with_attrib_exe.yml | 2 +- .../srs/ssa___modify_acls_permission_of_files_or_folders.yml | 2 +- dist/ssa/srs/ssa___resize_shadowstorage_volume.yml | 2 +- dist/ssa/srs/ssa___sdelete_application_execution.yml | 2 +- .../ssa___system_process_running_from_unexpected_location.yml | 2 +- dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 2 +- dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- dist/ssa/srs/ssa___windows_bits_job_persistence.yml | 2 +- dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_decode_file.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml | 2 +- .../srs/ssa___windows_curl_upload_to_remote_destination.yml | 2 +- .../srs/ssa___windows_defender_tools_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml | 2 +- .../srs/ssa___windows_dotnet_binary_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml | 2 +- .../ssa___windows_execute_arbitrary_commands_with_msdt.yml | 2 +- .../ssa___windows_ingress_tool_transfer_using_explorer.yml | 2 +- .../srs/ssa___windows_lolbin_binary_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_child_process.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_command_line_url.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml | 2 +- dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml | 2 +- ...indows_os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +- .../srs/ssa___windows_os_credential_dumping_with_procdump.yml | 2 +- ...dows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- dist/ssa/srs/ssa___windows_powershell_downloadfile.yml | 2 +- dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml | 2 +- dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml | 2 +- dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml | 2 +- dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml | 2 +- dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml | 2 +- ...em_binary_proxy_execution_compiled_html_file_decompile.yml | 2 +- ...proxy_execution_compiled_html_file_url_in_command_line.yml | 2 +- ...ion_compiled_html_file_using_infotech_storage_handlers.yml | 2 +- ...ystem_binary_proxy_execution_msiexec_dllregisterserver.yml | 2 +- ..._system_binary_proxy_execution_msiexec_remote_download.yml | 2 +- ...s_system_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +- dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- 57 files changed, 58 insertions(+), 58 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 602d8184bb..89a5ad5e02 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -38,7 +38,7 @@ class DetectionTags(BaseModel): observable_str: str = None kill_chain_phases_id: list = None research_site_url: str = None - data_schema: str = None + event_schema: str = None @validator('cis20') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 0588ed3fbc..a2e9ab02cf 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -36,7 +36,7 @@ class ObjToYmlAdapter(Adapter): obj.tags.research_site_url = research_site_url # add ocsf schema tag - obj.tags.data_schema = 'ocsf-1' + obj.tags.event_schema = 'cim' body = FindingReportObject.writeFindingReport(obj) @@ -64,7 +64,7 @@ class ObjToYmlAdapter(Adapter): "security_domain": True, "required_fields": True, "research_site_url": True, - "data_schema": True + "event_schema": True }, "test": { diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 0d2924c670..3951109d62 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -48,7 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ - data_schema: ocsf-1 + event_schema: cim test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 0d1113abd7..2b8bbf2856 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -56,7 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Attempt To Delete Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index be0953e4dd..21b2c3cef4 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -55,7 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Attempt To Disable Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 5b912cb735..86c11c526c 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -51,7 +51,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ - data_schema: ocsf-1 + event_schema: cim test: name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 89781243d1..b02663de71 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -49,7 +49,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ - data_schema: ocsf-1 + event_schema: cim test: name: BCDEdit Failure Recovery Modification Unit Test tests: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index c49d02891a..a92f58b8a3 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -55,7 +55,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Clear Unallocated Sector Using Cipher - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 237555509e..37c2168452 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -54,7 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Delete A Net User Unit Test tests: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 4018667b00..8515307f95 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -52,7 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Deny Permission using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 2c583e75b9..adb3125d68 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -54,7 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ - data_schema: ocsf-1 + event_schema: cim test: name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 7051ed7022..b135da3cef 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -59,7 +59,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Detect RClone Command-Line Usage Unit Test tests: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index ff3659693f..556eb62bef 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -55,7 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Disable Net User Account Unit Test tests: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 8fb8a33a3f..ed7dad7af8 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -55,7 +55,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: DNS Exfiltration Using Nslookup App Unit Test tests: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 43159a7ff1..8209ee9d9f 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -49,7 +49,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ - data_schema: ocsf-1 + event_schema: cim test: name: Fsutil Zeroing File Unit Test tests: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index c3ce56a44e..809e5c24fb 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -52,7 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Grant Permission Using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index b86e506ab0..99b10e933d 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -49,7 +49,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Hiding Files And Directories With Attrib exe - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 51c834744b..6c619d22d2 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -55,7 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Modify ACLs Permission Of Files Or Folders Unit Test tests: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index a32162fd81..2fb9f08374 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -54,7 +54,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Resize Shadowstorage Volume Unit Test tests: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index a2e08db8ae..0d69df7634 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -64,7 +64,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Sdelete Application Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index d8f1ce26d4..9275c01a89 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -250,7 +250,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ - data_schema: ocsf-1 + event_schema: cim test: name: System Process Running from Unexpected Location Unit Test tests: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index e96b78137e..63d39d6577 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -52,7 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ - data_schema: ocsf-1 + event_schema: cim test: name: WBAdmin Delete System Backups Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 0827c571ee..95d6c76585 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: WevtUtil Usage To Clear Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 9183afb2b6..07423e26d1 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -54,7 +54,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Wevtutil Usage To Disable Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 0963437242..5c7af5b92e 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -59,7 +59,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Bits Job Persistence Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 51e083bcaf..2946b8ccf7 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -66,7 +66,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Bitsadmin Download File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 4782310dd0..719689ca7a 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -60,7 +60,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows CertUtil Decode File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index bc161b4a34..5216c26024 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -57,7 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows CertUtil URLCache Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 878324f592..b6a47b60f8 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows CertUtil VerifyCtl Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 6c27744308..10e8d46901 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -67,7 +67,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Curl Upload to Remote Destination Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 47af958c2a..9d87d3a58e 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -46,7 +46,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Defender Tools in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index 9b1294c08b..90d2334b95 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -51,7 +51,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: BA Windows Diskshadow Proxy Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index ac24940a00..f395c33bb2 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -78,7 +78,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows DotNet Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index 1b33b5761d..675863574e 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -60,7 +60,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Eventvwr UAC Bypass Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 0a3473abbd..d879885f2f 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -62,7 +62,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Execute Arbitrary Commands with MSDT Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 6db1519f50..87af261043 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -56,7 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Ingress Tool Transfer Using Explorer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index a4c29ec06d..9720a34aa8 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -88,7 +88,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows LOLBin Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index abca0bb7a7..1d3ee91916 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -57,7 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows MSHTA Child Process Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 7070982712..bdf9b4f10b 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -59,7 +59,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows MSHTA Command-Line URL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 21702cf6a0..e513a24364 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -57,7 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows MSHTA Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index a4315cc554..aeb7821ec3 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -56,7 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Odbcconf Load Response File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 83ad8aa93c..e68bce816f 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -61,7 +61,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index 8da5700cdc..67b3121615 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows OS Credential Dumping with Procdump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 45a947cd37..233d0cd9fb 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -65,7 +65,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Powershell Connect to Internet With Hidden Window Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 7e85d25045..4b2fd1b8b7 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -59,7 +59,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Powershell DownloadFile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 5e297e000e..9b3a01fee9 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows PowerShell Start-BitsTransfer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 2d7429cb12..fe0fd6fcb9 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Rasautou DLL Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 6dcd53e5b2..d3bc032cd3 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -46,7 +46,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Rundll32 Comsvcs Memory Dump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 2900f9c3c3..aba7137395 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -60,7 +60,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Rundll32 Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index e76daddfdf..c805603cf1 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -57,7 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows Script Host Spawn MSBuild Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 3b1e46e3ec..0462226179 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 4de9c60cbf..46d1a88a92 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -65,7 +65,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line Unit Test diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 486f02d97c..761e9549da 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -68,7 +68,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers Unit Test diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index a1109f3ad1..e82961dfdd 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -48,7 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 4dfb7343ad..df4da75e69 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -48,7 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index ed5e44a5f3..df8bf50173 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -48,7 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index e5f12ca51d..659fd6da92 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -58,7 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ - data_schema: ocsf-1 + event_schema: cim test: name: Windows WMIPrvse Spawn MSBuild Unit Test tests: From ac4f6250354bdbac529cc26606396fcc48654bd1 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 31 Oct 2022 15:16:24 -0700 Subject: [PATCH 3/3] updating a file for code testing failure --- .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index 2098cad653..97e7ac5fb8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ + event_schema: cim test: name: Anomalous usage of Archive Tools Unit Test tests: