From bc7d8af43706bfd9f87bfb736f7571c820eaee40 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 6 Apr 2022 11:43:01 +0200 Subject: [PATCH] small improvements ssa generate --- .../srs/ssa___anomalous_usage_of_archive_tools.yml | 14 ++++++++------ .../srs/ssa___anomalous_usage_of_archive_tools.yml | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml index 39e6170e52..bf074423d8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -14,16 +14,18 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map | where process_name IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%") OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name, "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", timestamp, - "detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "tbd"), "string", null), "type_id", 0)], - "disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", timestamp, + "detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "dest_device_id"), "string", null), "type_id", 0)], + "disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", strftime(timestamp, "%Y-%m-%dT%H:%M:%S.%6QZ", "%Z"), "finding", create_map("confidence", 60, "confidence_id", 2, "context_ids", [10, 49], "impact", 70, "impact_id", 4, "kill_chain_phase", "Exploitation", "kill_chain_phase_id", 4, - "risk_level", "Medium", "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id), - "message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.", "metadata", create_map("log_name", "Endpoint_Processes", "version", - "1.0.0"), "observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), + "risk_level", "Medium", "risk_level_id", 2, "risk_score", 42, + "type_id", 1, "ref_event_uid", event_id), "message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.", + "metadata", create_map("log_name", "Endpoint_Processes", "version", "1.0.0"), + "observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], + "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), "rule", create_map("name", "Anomalous usage of Archive Tools"), "start_time", timestamp, "time", timestamp, - "user_entities", [create_map("uid", "tbd")]) + "user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))]) | into write_ssa_finding_events();' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index 39e6170e52..bf074423d8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -14,16 +14,18 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map | where process_name IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%") OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name, "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", timestamp, - "detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "tbd"), "string", null), "type_id", 0)], - "disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", timestamp, + "detection_end_time", timestamp, "device_entities", [create_map("uid", ucast(map_get(input_event, "dest_device_id"), "string", null), "type_id", 0)], + "disposition_id", 1, "end_time", timestamp, "event_id", 10100001, "event_time", strftime(timestamp, "%Y-%m-%dT%H:%M:%S.%6QZ", "%Z"), "finding", create_map("confidence", 60, "confidence_id", 2, "context_ids", [10, 49], "impact", 70, "impact_id", 4, "kill_chain_phase", "Exploitation", "kill_chain_phase_id", 4, - "risk_level", "Medium", "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id), - "message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.", "metadata", create_map("log_name", "Endpoint_Processes", "version", - "1.0.0"), "observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), + "risk_level", "Medium", "risk_level_id", 2, "risk_score", 42, + "type_id", 1, "ref_event_uid", event_id), "message", "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.", + "metadata", create_map("log_name", "Endpoint_Processes", "version", "1.0.0"), + "observables", [create_map("name", "user", "role_ids", [4], "type_id", 6, "value", user), create_map("name", "dest", "role_ids", [4], "type_id", 4, "value", dest), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], + "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), "rule", create_map("name", "Anomalous usage of Archive Tools"), "start_time", timestamp, "time", timestamp, - "user_entities", [create_map("uid", "tbd")]) + "user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))]) | into write_ssa_finding_events();' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from