From 7816778eae31326989ee331887e6562611b90631 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 15:45:00 -0700 Subject: [PATCH 1/5] Removed the field "user" from the stats line. It does not appear to exist in the raw data and is not pulled into any field(s). However, there is a field called userName which, presumably, represents the same data. --- detections/cloud/aws_ecr_container_scanning_findings_high.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index e298eeafc7..8df8f80d8b 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -1,7 +1,7 @@ name: AWS ECR Container Scanning Findings High id: 62721bd2-1d82-4623-b6e6-aac170014423 version: 1 -date: '2021-08-17' +date: '2022-06-21' author: Patrick Bareiss, Splunk type: TTP datamodel: [] @@ -14,7 +14,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) - as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, + as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This From b5c79b6db891f798a30678feba0227064c64e87c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 15:53:26 -0700 Subject: [PATCH 2/5] Added a custom index for a detection test that was created when custom_index support did not yet exist. --- tests/application/splunk_dos_via_malformed_s2s_request.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml index d2780a45e8..e17643a313 100644 --- a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml +++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml @@ -11,3 +11,4 @@ tests: source: /opt/splunk/var/log/splunk/splunkd.log sourcetype: splunkd update_timestamp: true + custom_index: _internal From 35908f5a304df9f608972a5a462402bdfdc554c5 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 16:25:20 -0700 Subject: [PATCH 3/5] Removed user from the stats call of this search since it does not exist and the field userName does exist. And it is likely to have captured the same data. --- detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index 388e2254b3..3b3ce65eca 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -15,7 +15,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, - user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` + userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. From b73ea9e5aefe73b77e150534a0fbc3cbdf410873 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 16:59:44 -0700 Subject: [PATCH 4/5] Added another custom_index to a test file that was failing because it did not have one. --- tests/application/path_traversal_spl_injection.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/application/path_traversal_spl_injection.test.yml b/tests/application/path_traversal_spl_injection.test.yml index f40d6cd7db..c59e89061f 100644 --- a/tests/application/path_traversal_spl_injection.test.yml +++ b/tests/application/path_traversal_spl_injection.test.yml @@ -10,3 +10,4 @@ tests: data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt source: c:\opt\splunk\var\log\splunk\splunkd_ui_access.log sourcetype: splunkd_ui_access + custom_index: _internal From 54203d68582fd6d5e51673dda1b41b74cb92b0a1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 17:21:30 -0700 Subject: [PATCH 5/5] Fixing detection to conform to new sysmon behavior. --- detections/endpoint/office_document_executing_macro_code.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 83a6ebc88d..bd6d5aecb7 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") +search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`