diff --git a/security_content_automation/detection_ta_mapping.yaml b/security_content_automation/detection_ta_mapping.yaml new file mode 100644 index 0000000000..9491fb6ae4 --- /dev/null +++ b/security_content_automation/detection_ta_mapping.yaml @@ -0,0 +1,802 @@ +Abnormally High Number Of Cloud Infrastructure API Calls Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Abnormally High Number Of Cloud Instances Destroyed Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Abnormally High Number Of Cloud Security Group API Calls Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_infoblox + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Abnormally High Number of Cloud Instances Launched Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Active Setup Registry Autostart Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Add DefaultUser And Password In Registry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Allow Inbound Traffic By Firewall Rule Registry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Allow Operation with Consent Admin Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Anomalous usage of 7zip Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Attacker Tools On Endpoint Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +Attempt To Add Certificate To Untrusted Store Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Auto Admin Logon Registry Entry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +BCDEdit Failure Recovery Modification: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Batch File Write to System32 Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +Bcdedit Command Back To Normal Mode Boot Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Change Default File Association Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Change To Safe Mode With Network Config Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Check Elevated CMD using whoami Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Cloud API Calls From Previously Unseen User Roles Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - splunk_ta_o365 + - Splunk_TA_box + - Splunk_TA_infoblox + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Compute Instance Created By Previously Unseen User Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Compute Instance Created In Previously Unused Region Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Compute Instance Created With Previously Unseen Image Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Compute Instance Created With Previously Unseen Instance Type Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Instance Modified By Previously Unseen User Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Provisioning Activity From Previously Unseen City Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Provisioning Activity From Previously Unseen Country Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Provisioning Activity From Previously Unseen IP Address Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +Cloud Provisioning Activity From Previously Unseen Region Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce + tas_with_data: + - Splunk_TA_aws-kinesis-firehose +DNS Query Length With High Standard Deviation Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_isc-bind + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_infoblox +DSQuery Domain Discovery Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Detect Exchange Web Shell Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Detect RClone Command-Line Usage Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Detect Regasm Spawning a Process Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Detect Regsvcs Regasm Spawning a Process Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Detect SharpHound Command-Line Arguments Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Detect Use of cmd exe to Launch Script Interpreters Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disable AMSI Through Registry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disable ETW Through Registry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disable Logs Using WevtUtil Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disable Registry Tool Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disable Schedule Task Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Disable Windows App Hotkeys Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disable Windows Behavior Monitoring Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disabling CMD Application Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disabling ControlPanel Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disabling FolderOptions Windows Feature Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disabling NoRun Windows App Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disabling SystemRestore In Registry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Disabling Task Manager Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Domain Account Discovery With Net App Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Domain Account Discovery with Wmic Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Dump LSASS via procdump Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Enable RDP In Other Port Number Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Eventvwr UAC Bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Excessive Attempt To Disable Services Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Excessive Usage Of Cacls App Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Excessive Usage Of Taskkill Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Excessive number of distinct processes created in Windows Temp folder Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm + tas_with_data: + - Splunk_TA_windows +Excessive number of service control start as disabled Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Excessive number of taskhost processes Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + tas_with_data: + - Splunk_TA_windows +Executables Or Script Creation In Suspicious Path Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Execute Javascript With Jscript COM CLSID Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Execution of File with Multiple Extensions Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +File with Samsam Extension Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +Firewall Allowed Program Enable Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +FodHelper UAC Bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Fsutil Zeroing File Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Get ADUserResultantPasswordPolicy with Powershell Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Get DomainPolicy with Powershell Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Get DomainUser with PowerShell Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +GetWmiObject DS User with PowerShell Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Hide User Account From Sign-In Screen Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Hiding Files And Directories With Attrib exe Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows +ICACLS Grant Command Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Icacls Deny Command Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Jscript Execution Using Cscript App Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Logon Script Event Trigger Execution Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Modify ACL permission To Files Or Folder Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Msmpeng Application DLL Side Loading Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +NET Profiler UAC bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +NLTest Domain Trust Discovery: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +NTdsutil export ntds dit Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Overwriting Accessibility Binaries Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +Permission Modification using Takeown App Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Powershell Execute COM Object Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_cisco-ucs + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_nginx + - Splunk_TA_microsoft-iis + - Splunk_TA_microsoft-sqlserver + - Splunk_TA_rsa-securid + - Splunk_TA_remedy + - Splunk_TA_bluecoat-proxysg + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_jboss + - Splunk_TA_websense-cg + - Splunk_TA_ossec + - Splunk_TA_bromium + - Splunk_TA_nagios-core + - Splunk_TA_isc-bind + - Splunk_TA_bit9-carbonblack + - Splunk_TA_snow + - Splunk_TA_squid + - Splunk_TA_apache + - Splunk_TA_imperva-waf + - Splunk_TA_juniper + - Splunk_TA_cisco-esa + - Splunk_TA_microsoft_sysmon + - Splunk_TA_cisco-ise + - splunk_ta_o365 + - Splunk_TA_f5-bigip + - Splunk_TA_symantec-ep + - Splunk_TA_google-cloudplatform + - Splunk_TA_sophos + - Splunk_TA_mcafee_epo_syslog + - Splunk_TA_haproxy + - Splunk_TA_tomcat + - Splunk_TA_jmx + - Splunk_TA_cyberark + - Splunk_TA_symantec-dlp + - Splunk_TA_ibm-was + - Splunk_TA_microsoft-hyperv + - Splunk_TA_windows + - Splunk_TA_mcafee-wg + - Splunk_TA_isc-dhcp + - Splunk_TA_websense-dlp + - Splunk_TA_box + - Splunk_TA_microsoft-scom + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_rsa-dlp + - Splunk_TA_cisco-wsa + - Splunk_TA_mysql + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce + - Splunk_TA_cyberark_epm + - Splunk_TA_linux + - Splunk_TA_oracle + tas_with_data: + - Splunk_TA_windows +Prevent Automatic Repair Mode using Bcdedit Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Print Processor Registry Autostart Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Process Creating LNK file in Suspicious location Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Process execution via wmi Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Processes created by netsh Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Reg exe Manipulating Windows Services Registry Keys Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Registry Keys Used For Persistence Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Remote WMI Command Attempt Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Resize ShadowStorage volume Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Revil Common Exec Parameter Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Revil Registry Entry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Ryuk Wake on LAN Command Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +SLUI RunAs Elevated Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +SLUI Spawning a Process Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Samsam Test File Write Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +Sc exe Manipulating Windows Services Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Scheduled Task Deleted Or Created Via CMD: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Schtasks Run Task On Demand Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Schtasks scheduling job on remote system Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Schtasks used for forcing a reboot Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Screensaver Event Trigger Execution Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Script Execution via WMI Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +Sdclt UAC Bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +SecretDumps Offline NTDS Dumping Tool Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Services Escalate Exe Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Shim Database Installation With Suspicious Parameters Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Short Lived Windows Accounts Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_cyberark +SilentCleanup UAC Bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Single Letter Process On Endpoint Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +Spoolsv Writing a DLL Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +Start Up During Safe Mode Boot Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Suspicious File Write Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Suspicious Process File Path Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Suspicious Reg exe Process Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Suspicious Scheduled Task from Public Directory Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Suspicious mshta child process Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +System Information Discovery Detection Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +System Processes Run From Unexpected Locations Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +Time Provider Persistence Registry Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +USN Journal Deletion Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Unified Messaging Service Spawning a Process Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Uninstall App Using MsiExec Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Unload Sysmon Filter Driver Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +WBAdmin Delete System Backups Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_CrowdStrike_FDR +WSReset UAC Bypass Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Windows AdFind Exe Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +Windows Disable Antispyware Reg Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack +XSL Script Execution With WMIC Unit Test: + CIM_version: 4.20.2 + supported_tas: + - Splunk_TA_bit9-carbonblack diff --git a/security_content_automation/enrich_detections.py b/security_content_automation/enrich_detections.py new file mode 100644 index 0000000000..9bd3569e75 --- /dev/null +++ b/security_content_automation/enrich_detections.py @@ -0,0 +1,270 @@ +# 1. Take github token, branch_name from user to raise a PR for enriched detection of security_content repo +# 2. Iterate through each detection file +# 3. For each detection iterate through ta_cim_mapping report +# 4. map detection file and ta_cim_mapping reports and finalise the TA required for particular detection +# 5. Add the list of TA's in detection file +# 6. Create a new branch and raise an MR for it + +import os +import git +import sys +import shutil +import yaml +import json +import time +import argparse +import logging +import io +import re +from github import Github + + +def fetch_ta_cim_mapping_report(file_name): + try: + with open(file_name) as file_content: + cim_field_report = json.load(file_content) + return cim_field_report + except Exception as error: + error_message = f"Unexpected error occurred while reading file. Error: {error}" + logging.error(error_message) + + +def load_file(file_path): + with open(file_path, "r", encoding="utf-8") as stream: + try: + file = list(yaml.safe_load_all(stream))[0] + except yaml.YAMLError as exc: + sys.exit("ERROR: reading {0}".format(file_path)) + return file + + +def map_required_fields(cim_summary, datamodel, required_fields): + datasets_fields = {} + add_addon = True + flag = 0 + for item in required_fields: + if re.match("^[A-Za-z0-9_.]*$", item): + if item == "_time" or item == "_times": + continue + else: + dataset_field = item.split(".") + length = len(dataset_field) + if length == 1: + dataset = datamodel[0] + field = dataset_field[0] + else: + dataset = dataset_field[length - 2] + field = dataset_field[length - 1] + if dataset not in datasets_fields: + datasets_fields[dataset] = [] + datasets_fields[dataset].append(field) + + for dataset in datasets_fields: + add_addon = False + mapping_set = datamodel[0] + ":" + dataset + for item in cim_summary: + if mapping_set in item: + for eventtype in cim_summary[item].values(): + for e_type in eventtype: + cim_fields = e_type.get("fields", []) + if set(datasets_fields[dataset]).issubset(set(cim_fields)): + add_addon = True + + return add_addon + + +def is_valid_detection_file(filepath) -> bool: + """ + check if detection file have valid analytic type and have valid + data-model name. + :param detection_test_path: detection test path i.e. security_content/tests/cloud + :param test_file: detection test file name + :param detection_products: detection tag product list for which detection test will filterised + :return: boolean + """ + detection_analytic_type = ["ttp", "anomaly"] + detection_with_valid_analytic_type = False + detection_with_valid_datamodel = False + detection_file_path = load_file(filepath) + + if detection_file_path.get("type", "").lower() in detection_analytic_type: + detection_with_valid_analytic_type = True + + if detection_file_path.get("datamodel", []): + detection_with_valid_datamodel = True + + return detection_with_valid_analytic_type & detection_with_valid_datamodel + + +def enrich_detection_file(file, ta_list, keyname): + # file_path = 'security_content/detections/' + test['detection_result']['detection_file'] + detection_obj = load_file(file) + detection_obj["tags"][keyname] = ta_list + + with open(file, "w") as f: + yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True) + + +def main(): + + parser = argparse.ArgumentParser( + description="Enrich detections with relevant TA names" + ) + parser.add_argument( + "-scr", + "--security_content_repo", + required=False, + default="kirtankhatana-crest/security_content", + help="specify the url of the security content repository", + ) + parser.add_argument( + "-scb", + "--security_content_branch", + required=False, + default="develop", + help="specify the security content branch", + ) + parser.add_argument( + "-gt", + "--github_token", + required=False, + default=os.environ.get("GIT_TOKEN"), + help="specify the github token for the PR", + ) + + args = parser.parse_args() + security_content_repo = args.security_content_repo + security_content_branch = args.security_content_branch + github_token = args.github_token + g = Github(github_token) + detection_types = ["cloud", "endpoint", "network"] + + # clone security content repository + security_content_repo_obj = git.Repo.clone_from( + "https://" + + github_token + + ":x-oauth-basic@github.com/" + + security_content_repo, + "security_content", + branch=security_content_branch, + ) + + # clone ta cim field reports repository + ta_cim_field_reports_obj = git.Repo.clone_from( + "https://" + + github_token + + ":x-oauth-basic@github.com/" + + "splunk/ta-cim-field-reports", + "ta_cim_mapping_reports", + branch="feat/cim-field-mapping", + ) + + # iterate for every detection types + detection_ta_mapping = {} + for detection_type in detection_types: + + for subdir, _, files in os.walk(f"security_content/tests/{detection_type}"): + print(subdir) + for file in files: + filepath = subdir + os.sep + file + supported_ta_list = [] + tas_with_data_list = [] + detection_obj = load_file(filepath) + detection_name = detection_obj["name"] + source_type = ( + detection_obj.get("tests")[0] + .get("attack_data")[0] + .get("sourcetype") + ) + filepath = "security_content/detections/" + detection_obj.get("tests")[ + 0 + ].get("file") + if is_valid_detection_file(filepath): + for ta_cim_mapping_file in os.listdir( + "./ta_cim_mapping_reports/ta_cim_mapping/cim_mapping_reports/latest/" + ): + + ta_cim_map = fetch_ta_cim_mapping_report( + "./ta_cim_mapping_reports/ta_cim_mapping/cim_mapping_reports/latest/" + + ta_cim_mapping_file + ) + + detection_obj = load_file(filepath) + required_fields = detection_obj.get("tags", {}).get( + "required_fields" + ) + datamodel = detection_obj.get("datamodel", []) + result = map_required_fields( + ta_cim_map["cimsummary"], datamodel, required_fields + ) + cim_version = ta_cim_map["cim_version"] + + if result: + supported_ta_list.append( + ta_cim_map.get("ta_name").get("name") + ) + ta_sourcetype = ta_cim_map["sourcetypes"] + if source_type in ta_sourcetype: + tas_with_data_list.append( + ta_cim_map.get("ta_name").get("name") + ) + detection_ta_mapping[detection_name] = {} + + if supported_ta_list: + keyname = "supported_tas" + print(filepath) + enrich_detection_file(filepath, cim_version, "CIM_version") + enrich_detection_file(filepath, supported_ta_list, keyname) + detection_ta_mapping[detection_name][ + "CIM_version" + ] = cim_version + detection_ta_mapping[detection_name][ + keyname + ] = supported_ta_list + + if tas_with_data_list: + keyname = "tas_with_data" + enrich_detection_file(filepath, tas_with_data_list, keyname) + detection_ta_mapping[detection_name][ + keyname + ] = tas_with_data_list + + security_content_repo_obj.index.add( + [filepath.strip("security_content/")] + ) + + print("done") + with io.open( + r"./security_content_automation/detection_ta_mapping.yaml", "w", encoding="utf8" + ) as outfile: + yaml.safe_dump( + detection_ta_mapping, outfile, default_flow_style=False, allow_unicode=True + ) + + security_content_repo_obj.index.commit( + "Updated detection files with supported TA list." + ) + + epoch_time = str(int(time.time())) + branch_name = "security_content_automation_" + epoch_time + security_content_repo_obj.git.checkout("-b", branch_name) + + security_content_repo_obj.git.push("--set-upstream", "origin", branch_name) + repo = g.get_repo("kirtankhatana-crest/security_content") + + pr = repo.create_pull( + title="Enrich Detection PR " + branch_name, + body="This is a dummy PR", + head=branch_name, + base="develop", + ) + + try: + shutil.rmtree("./security_content") + shutil.rmtree("./ta_cim_mapping_reports") + except OSError as e: + print("Error: %s - %s." % (e.filename, e.strerror)) + + +if __name__ == "__main__": + main() diff --git a/security_content_automation/requirements.txt b/security_content_automation/requirements.txt new file mode 100644 index 0000000000..8552a5cfcb --- /dev/null +++ b/security_content_automation/requirements.txt @@ -0,0 +1,2 @@ +GitPython==3.1.24 +PyYAML==6.0 \ No newline at end of file