admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

small improvements ssa generate

Browse Source
This commit is contained in:
P4T12ICK
2022-04-06 11:43:01 +02:00
parent be59f544d0
commit bc7d8af437
2 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml
+8 -6
View File
@@ -14,16 +14,18 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
| where process_name IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name,
"7z%") OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
"%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", timestamp,
"detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "tbd"), "string", null), "type_id", 0)],
"disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", timestamp,
"detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "dest_device_id"), "string", null), "type_id", 0)],
"disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", strftime(timestamp, "%Y-%m-%dT%H:%M:%S.%6QZ", "%Z"),
"finding", create_map("confidence", 60, "confidence_id", 2,
"context_ids", [10, 49], "impact", 70, "impact_id", 4,
"kill_chain_phase", "Exploitation", "kill_chain_phase_id", 4,
"risk_level", "Medium", "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id),
"message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.", "metadata", create_map("log_name", "Endpoint_Processes", "version",
"1.0.0"), "observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"risk_level", "Medium", "risk_level_id", 2, "risk_score", 42,
"type_id", 1, "ref_event_uid", event_id), "message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.",
"metadata", create_map("log_name", "Endpoint_Processes", "version", "1.0.0"),
"observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)],
"origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"rule", create_map("name", "Anomalous usage of Archive Tools"), "start_time", timestamp, "time", timestamp,
"user_entities", [create_map("uid", "tbd")])
"user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))])
| into write_ssa_finding_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml
+8 -6
View File
@@ -14,16 +14,18 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
| where process_name IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name,
"7z%") OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
"%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", timestamp,
"detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "tbd"), "string", null), "type_id", 0)],
"disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", timestamp,
"detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "dest_device_id"), "string", null), "type_id", 0)],
"disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", strftime(timestamp, "%Y-%m-%dT%H:%M:%S.%6QZ", "%Z"),
"finding", create_map("confidence", 60, "confidence_id", 2,
"context_ids", [10, 49], "impact", 70, "impact_id", 4,
"kill_chain_phase", "Exploitation", "kill_chain_phase_id", 4,
"risk_level", "Medium", "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id),
"message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.", "metadata", create_map("log_name", "Endpoint_Processes", "version",
"1.0.0"), "observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"risk_level", "Medium", "risk_level_id", 2, "risk_score", 42,
"type_id", 1, "ref_event_uid", event_id), "message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.",
"metadata", create_map("log_name", "Endpoint_Processes", "version", "1.0.0"),
"observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)],
"origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"rule", create_map("name", "Anomalous usage of Archive Tools"), "start_time", timestamp, "time", timestamp,
"user_entities", [create_map("uid", "tbd")])
"user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))])
| into write_ssa_finding_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from