Branch was auto-updated.

.github/workflows/code-testing.yml

@@ -1,8 +1,6 @@
 name: code-testing
 on:
   push:
-    paths:
-      - 'bin/contentctl_project/**'
 
 jobs:
   code-testing:
@@ -35,4 +33,4 @@ jobs:
         run: |
           source venv/bin/activate
           export PYTHONPATH=$PYTHONPATH:/home/runner/work/security_content
-          pytest -s bin/contentctl_project 
+          pytest -s bin/contentctl_project 

bin/contentctl_project/contentctl_core/application/use_cases/reporting.py

@@ -20,7 +20,8 @@ class Reporting:
         factory = Factory(factory_output_dto)
         factory.execute(input_dto.factory_input_dto)
 
-        input_dto.adapter_svg.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../reporting'))
-        input_dto.adapter_attack.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../../docs/mitre-map'))
-
+        
+        input_dto.adapter_svg.writeObjects(factory_output_dto.detections, os.path.join(input_dto.factory_input_dto.input_path, 'bin', 'reporting'))
+        input_dto.adapter_attack.writeObjects(factory_output_dto.detections, os.path.join(input_dto.factory_input_dto.input_path, 'docs', 'mitre-map'))
+        
         print('Reporting of security content successful.')

bin/contentctl_project/contentctl_core/domain/entities/baseline.py

@@ -86,17 +86,9 @@ class Baseline(BaseModel, SecurityContentObject):
 
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Baseline!"))
-        
 
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
+
 
     @validator('search')
     def search_validate(cls, v, values):

bin/contentctl_project/contentctl_core/domain/entities/detection.py

@@ -133,18 +133,7 @@ class Detection(BaseModel, SecurityContentObject):
    
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Detection!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
-        return v
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
 
     @validator('search')
     def search_validate(cls, v, values):

bin/contentctl_project/contentctl_core/domain/entities/investigation.py

@@ -83,17 +83,7 @@ class Investigation(BaseModel, SecurityContentObject):
 
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Investigation!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
 
     @validator('search')
     def search_validate(cls, v, values):

bin/contentctl_project/contentctl_core/domain/entities/link_validator.py

@@ -1,4 +1,3 @@
-from lib2to3.pytree import Base
 import re
 from tracemalloc import start
 from unittest.mock import DEFAULT
@@ -157,3 +156,19 @@ class LinkValidator(abc.ABC):
             print(f"Link {failure.reference} invalid with HTTP Status Code [{failure.status_code}] and referenced by the following files:")
             for ref in failure.referencing_files:
                 print(f"\t* {ref}")
+
+    @staticmethod
+    def SecurityContentObject_validate_references(v:list, values: dict)->list:
+        if 'check_references' not in values:
+            raise(Exception("Member 'check_references' missing from Baseline!"))
+        elif values['check_references'] is False:
+            #Reference checking is enabled
+            pass
+        elif values['check_references'] is True:
+            for reference in v:
+                LinkValidator.validate_reference(reference, values['name'])
+                #Remove the check_references key from the values dict so that it is not
+        #output by the serialization code
+        del values['check_references']
+
+        return v

bin/contentctl_project/contentctl_core/domain/entities/playbook.py

@@ -28,15 +28,5 @@ class Playbook(BaseModel, SecurityContentObject):
     
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Playbook!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
 

bin/contentctl_project/contentctl_core/domain/entities/story.py

@@ -65,14 +65,4 @@ class Story(BaseModel, SecurityContentObject):
 
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Story!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)

bin/contentctl_project/contentctl_core/tests/application/factory/test_factory.py

@@ -1,5 +1,6 @@
 import os
 from re import A
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryInputDto
 from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryOutputDto
@@ -25,9 +26,9 @@ def test_factory_ESCU():
         SecurityContentStoryBuilder(),
         SecurityContentBaselineBuilder(),
         SecurityContentInvestigationBuilder(),
-        SecurityContentPlaybookBuilder(),
+        SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT),
         SecurityContentDirector(),
-        AttackEnrichment.get_attack_lookup()
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT)
     )
 
     output_dto = FactoryOutputDto([],[],[],[],[],[],[],[],[])

bin/contentctl_project/contentctl_core/tests/application/use_cases/test_content_changer.py

@@ -1,4 +1,5 @@
 import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_core.application.use_cases.content_changer import ContentChanger, ContentChangerInputDto
 from bin.contentctl_project.contentctl_core.application.factory.object_factory import ObjectFactoryInputDto
@@ -21,7 +22,7 @@ def test_content_changer_author_uppercase():
     )
 
     input_dto = ContentChangerInputDto(
-        ObjToYmlAdapter(),
+        ObjToYmlAdapter(input_path = SECURITY_CONTENT_ROOT),
         factory_input_dto,
         'example_converter_func'
     )

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py

@@ -1,6 +1,8 @@
+from dataclasses import dataclass
 import os
 import glob
 import shutil
+from typing import Union
 
 from bin.contentctl_project.contentctl_core.application.adapter.adapter import Adapter
 from bin.contentctl_project.contentctl_infrastructure.adapter.conf_writer import ConfWriter
@@ -8,6 +10,10 @@ from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import S
 
 
 class ObjToConfAdapter(Adapter):
+    input_path: str
+
+    def __init__(self, input_path: str):
+        self.input_path = input_path
 
     def writeHeaders(self, output_folder: str) -> None:
         ConfWriter.writeConfFileHeader(os.path.join(output_folder, 'default/analyticstories.conf'))
@@ -83,7 +89,11 @@ class ObjToConfAdapter(Adapter):
                 os.path.join(output_path, 'default/transforms.conf'), 
                 objects)
 
-            files = glob.iglob(os.path.join(os.path.dirname(__file__), '../../../..' , 'lookups', '*.csv'))
+
+            if self.input_path is None:
+                raise(Exception(f"input_path is required for lookups, but received [{self.input_path}]"))
+
+            files = glob.iglob(os.path.join(self.input_path, 'lookups', '*.csv'))
             for file in files:
                 if os.path.isfile(file):
                     shutil.copy(file, os.path.join(output_path, 'lookups'))

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py

@@ -7,6 +7,10 @@ from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import S
 from bin.contentctl_project.contentctl_infrastructure.adapter.finding_report_writer import FindingReportObject
 
 class ObjToYmlAdapter(Adapter):
+    input_path: str
+
+    def __init__(self, input_path:str):
+        self.input_path = input_path
 
     def writeObjectsInPlace(self, objects: list) -> None:
         for object in objects:
@@ -85,7 +89,7 @@ class ObjToYmlAdapter(Adapter):
 
     def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None:
         if type == SecurityContentType.detections:
-            file_path = os.path.join(os.path.dirname(__file__), '../../../../detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product']))
+            file_path = os.path.join(self.input_path, 'detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product']))
             test_obj = {}
             test_obj['name'] = object['name'] + ' Unit Test'
             test_obj['tests'] = [
@@ -106,11 +110,13 @@ class ObjToYmlAdapter(Adapter):
                     ]
                 }
             ]
-            file_path_test = os.path.join(os.path.dirname(__file__), '../../../../tests', object['source'], self.convertNameToTestFileName(object['name'],object['tags']['product']))
+            file_path_test = os.path.join(self.input_path, 'tests', object['source'], self.convertNameToTestFileName(object['name'],object['tags']['product']))
             YmlWriter.writeYmlFile(file_path_test, test_obj)
             object.pop('source')
         elif type == SecurityContentType.stories:
-            file_path = os.path.join(os.path.dirname(__file__), '../../../../stories', self.convertNameToFileName(object['name'],object['tags']['product']))
+            file_path = os.path.join(self.input_path, 'stories', self.convertNameToFileName(object['name'],object['tags']['product']))
+        else:
+            raise(Exception(f"Object Must be Story or Detection, but is not: {object}"))
 
         YmlWriter.writeYmlFile(file_path, object)
 

bin/contentctl_project/contentctl_infrastructure/builder/attack_enrichment.py

@@ -13,10 +13,10 @@ logging.getLogger('taxii2client').setLevel(logging.CRITICAL)
 class AttackEnrichment():
 
     @classmethod
-    def get_attack_lookup(self, store_csv = None, force_cached_or_offline: bool = False, skip_enrichment:bool = False) -> dict:
+    def get_attack_lookup(self, input_path: str, store_csv = None, force_cached_or_offline: bool = False, skip_enrichment:bool = False) -> dict:
         print("Getting MITRE Attack Enrichment Data. This may take some time...")
         attack_lookup = dict()
-        file_path = os.path.join(os.path.dirname(__file__), '../../../../lookups/mitre_enrichment.csv')
+        file_path = os.path.join(input_path, "lookups", "mitre_enrichment.csv")
 
         if skip_enrichment is True:
             print("Skipping enrichment")

bin/contentctl_project/contentctl_infrastructure/builder/security_content_playbook_builder.py

@@ -12,10 +12,13 @@ from bin.contentctl_project.contentctl_infrastructure.builder.yml_reader import
 
 class SecurityContentPlaybookBuilder(PlaybookBuilder):
     playbook: Playbook
+    input_path: str
     check_references: bool
     
-    def __init__(self, check_references: bool = False):
+    
+    def __init__(self, input_path: str, check_references: bool = False):
         self.check_references = check_references
+        self.input_path = input_path
 
     def setObject(self, path: str) -> None:
         yml_dict = YmlReader.load_file(path)
@@ -60,7 +63,7 @@ class SecurityContentPlaybookBuilder(PlaybookBuilder):
 
 
     def findDetectionPath(self, detection_name: str) -> str:
-        for path in Path(os.path.join(os.path.dirname(__file__), '../../../../detections')).rglob(self.convertNameToFileName(detection_name) + '.yml'):
+        for path in Path(os.path.join(self.input_path, 'detections')).rglob(self.convertNameToFileName(detection_name) + '.yml'):
             normalized_path = os.path.normpath(path)
             path_components = normalized_path.split(os.sep)
             value_index = path_components.index('detections')

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf

@@ -35,7 +35,7 @@ providing_technologies = []
 category = Malware
 last_updated = 2021-05-12
 version = 1
-references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
+references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
 searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Get Parent Process Info - Response Task"]

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf

@@ -35,7 +35,7 @@ providing_technologies = []
 category = Malware
 last_updated = 2021-05-12
 version = 1
-references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
+references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
 searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Get Parent Process Info - Response Task"]

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json

@@ -1 +1 @@
-{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}
+{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json

@@ -1 +1 @@
-{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/jhernandez/splunk/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]}
+{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "check_references": false, "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/private/tmp/pytest/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json

@@ -1 +1 @@
-{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
+{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json

@@ -1 +1 @@
-{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]}
+{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "check_references": false, "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories_ref.json

@@ -1 +1 @@
-{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly 2.0", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]}
+{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly 2.0", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]}

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md

@@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 #### Reference
 
 * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 
 
 

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md

@@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 #### Reference
 
 * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 
 
 

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py

@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_md_adapter import ObjToMdAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -46,7 +47,7 @@ def test_svg_writer():
         '../builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml'))
     test = unit_test_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -54,7 +55,7 @@ def test_svg_writer():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     adapter = ObjToAttackNavAdapter()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py

@@ -2,6 +2,8 @@ import os
 import datetime
 import pytest
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
+
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_conf_adapter import ObjToConfAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
@@ -40,7 +42,7 @@ def test_write_conf_files(patch_datetime_now):
     director.constructDeployment(deployment_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject()
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -71,7 +73,7 @@ def test_write_conf_files(patch_datetime_now):
         [detection], [baseline], [investigation])
     story = story_builder.getObject()
     output_path = os.path.join(os.path.dirname(__file__), 'data')
-    adapter = ObjToConfAdapter()
+    adapter = ObjToConfAdapter(input_path = SECURITY_CONTENT_ROOT)
     adapter.writeHeaders(output_path)
     adapter.writeObjects([detection, detection_deprecated], output_path, SecurityContentType.detections)
     adapter.writeObjects([story], output_path, SecurityContentType.stories)

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py

@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_json_adapter import ObjToJsonAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
@@ -29,7 +30,7 @@ def test_write_detections():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [], [], [], [],
-        AttackEnrichment.get_attack_lookup(), [macro], [lookup])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [macro], [lookup])
     detection = detection_builder.getObject()
     
     output_path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data')
@@ -141,7 +142,7 @@ def test_write_stories():
         '../builder/test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject() 
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -159,7 +160,7 @@ def test_write_stories():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     investigation_builder = SecurityContentInvestigationBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py

@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_md_adapter import ObjToMdAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -46,7 +47,7 @@ def test_md_writer():
         '../builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml'))
     test = unit_test_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -54,15 +55,15 @@ def test_md_writer():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/deprecated/detect_new_user_aws_console_login.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection_deprecated = detection_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py

@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_md_adapter import ObjToMdAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -46,7 +47,7 @@ def test_svg_writer():
         '../builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml'))
     test = unit_test_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -54,7 +55,7 @@ def test_svg_writer():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     adapter = ObjToSvgAdapter()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_yml_adapter.py

@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.builder.yml_reader import YmlReader
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_yml_adapter import ObjToYmlAdapter
@@ -12,7 +13,7 @@ def test_read_and_write_yml():
     file_path = os.path.join(os.path.dirname(__file__), 
         'obj_to_yml_data/attempted_credential_dump_from_registry_via_reg_exe.yml')
     yml_obj = YmlReader.load_file(file_path)
-    adapter = ObjToYmlAdapter()
+    adapter = ObjToYmlAdapter(input_path = SECURITY_CONTENT_ROOT)
     adapter.writeObjectsInPlace([yml_obj])
 
     ref_file_path = os.path.join(os.path.dirname(__file__), 
@@ -35,7 +36,7 @@ def test_write_ssa_detection():
         {}, [], [])
     detection = detection_builder.getObject()
 
-    adapter = ObjToYmlAdapter()
+    adapter = ObjToYmlAdapter(input_path = SECURITY_CONTENT_ROOT)
     adapter.writeObjects([detection], os.path.join(os.path.dirname(__file__), 'obj_to_yml_data'))
 
     detection_file_path = os.path.join(os.path.dirname(__file__), 

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_attack_enrichment.py

@@ -1,8 +1,9 @@
-
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment
 
 
+
 def test_mitre_attack_enrichment():
-    attack_enrichment = AttackEnrichment.get_attack_lookup()
+    attack_enrichment = AttackEnrichment.get_attack_lookup(SECURITY_CONTENT_ROOT)
     assert attack_enrichment["T1003.002"]["technique"] == "Security Account Manager"

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py

@@ -1,5 +1,6 @@
 import pytest
 import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentProduct
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
@@ -12,6 +13,7 @@ from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_playbook_builder import SecurityContentPlaybookBuilder
 
 
+
 def test_read_detection():
     security_content_builder = SecurityContentDetectionBuilder()
     security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
@@ -112,7 +114,7 @@ def test_detection_add_rba():
 
 
 def test_detection_add_playbooks():
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -160,7 +162,7 @@ def test_attack_enrichment():
     security_content_builder = SecurityContentDetectionBuilder()
     security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'))
-    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup())
+    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT))
     detection = security_content_builder.getObject()
 
     assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_id'] == 'T1003.002'

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py

@@ -1,5 +1,6 @@
-import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
+import os
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
@@ -12,6 +13,7 @@ from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_playbook_builder import SecurityContentPlaybookBuilder
 
 
+
 def test_construct_deployments():
     director = SecurityContentDirector()
     deployment_builder = SecurityContentBasicBuilder()
@@ -48,7 +50,7 @@ def test_construct_macros():
 
 def test_construct_playbooks():
     director = SecurityContentDirector()
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()     
@@ -118,7 +120,7 @@ def test_construct_detections():
         'test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject() 
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -141,7 +143,7 @@ def test_construct_detections():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [macro], [lookup])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [macro], [lookup])
     detection = detection_builder.getObject()
 
     valid_annotations = {'mitre_attack': ['T1003.002', 'T1003'], 
@@ -186,7 +188,7 @@ def test_construct_stories():
         'test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject() 
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -204,7 +206,7 @@ def test_construct_stories():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     investigation_builder = SecurityContentInvestigationBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py

@@ -1,11 +1,14 @@
-import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
+import os
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_playbook_builder import SecurityContentPlaybookBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
 
 
+
+
 def test_read_playbook():
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -15,7 +18,7 @@ def test_read_playbook():
 
 def test_enrich_detections():
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook_builder.addDetections()

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py

@@ -1,5 +1,6 @@
-import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
+import os
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_story_builder import SecurityContentStoryBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
@@ -9,6 +10,8 @@ from bin.contentctl_project.contentctl_infrastructure.builder.security_content_b
 from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment
 
 
+
+
 def test_read_story():
     story_builder = SecurityContentStoryBuilder()
     story_builder.setObject(os.path.join(os.path.dirname(__file__), 
@@ -23,7 +26,7 @@ def test_add_detections():
     security_content_builder = SecurityContentDetectionBuilder()
     security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'))
-    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup())
+    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup(input_path=SECURITY_CONTENT_ROOT))
     detection = security_content_builder.getObject()
 
     story_builder = SecurityContentStoryBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/test_constants.py

@@ -0,0 +1,4 @@
+#Some constants that will be used in testing
+import os
+
+SECURITY_CONTENT_ROOT = os.getcwd()

contentctl.py

@@ -76,7 +76,7 @@ def content_changer(args) -> None:
     )
 
     input_dto = ContentChangerInputDto(
-        ObjToYmlAdapter(),
+        ObjToYmlAdapter(args.path),
         factory_input_dto,
         args.change_function
     )
@@ -109,9 +109,9 @@ def generate(args) -> None:
             SecurityContentStoryBuilder(),
             SecurityContentBaselineBuilder(),
             SecurityContentInvestigationBuilder(),
-            SecurityContentPlaybookBuilder(),
+            SecurityContentPlaybookBuilder(input_path=args.path),
             SecurityContentDirector(),
-            AttackEnrichment.get_attack_lookup(force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
+            AttackEnrichment.get_attack_lookup(args.path, force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
         )
     if args.product in ["SSA", "API"]:
         ba_factory_input_dto = BAFactoryInputDto(
@@ -127,7 +127,7 @@ def generate(args) -> None:
             os.path.abspath(args.output),
             factory_input_dto,
             ba_factory_input_dto,
-            ObjToConfAdapter(),
+            ObjToConfAdapter(args.path),
             SecurityContentProduct.ESCU
         )
     elif args.product == "API":
@@ -144,7 +144,7 @@ def generate(args) -> None:
             os.path.abspath(args.output),
             factory_input_dto,
             ba_factory_input_dto,
-            ObjToYmlAdapter(),
+            ObjToYmlAdapter(args.path),
             SecurityContentProduct.SSA
         ) 
     generate = Generate()
@@ -176,9 +176,9 @@ def validate(args) -> None:
             SecurityContentStoryBuilder(check_references=args.check_references),
             SecurityContentBaselineBuilder(check_references=args.check_references),
             SecurityContentInvestigationBuilder(check_references=args.check_references),
-            SecurityContentPlaybookBuilder(check_references=args.check_references),
+            SecurityContentPlaybookBuilder(input_path=args.path, check_references=args.check_references),
             SecurityContentDirector(),
-            AttackEnrichment.get_attack_lookup(force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
+            AttackEnrichment.get_attack_lookup(args.path, force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
         )
     if args.product in ["SSA", "all"]:
         ba_factory_input_dto = BAFactoryInputDto(
@@ -218,9 +218,9 @@ def doc_gen(args) -> None:
         SecurityContentStoryBuilder(),
         SecurityContentBaselineBuilder(),
         SecurityContentInvestigationBuilder(),
-        SecurityContentPlaybookBuilder(),
+        SecurityContentPlaybookBuilder(input_path=args.path),
         SecurityContentDirector(),
-        AttackEnrichment.get_attack_lookup(force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
+        AttackEnrichment.get_attack_lookup(args.path, force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
     )
 
     doc_gen_input_dto = DocGenInputDto(
@@ -243,7 +243,7 @@ def new_content(args) -> None:
         sys.exit(1)
 
     new_content_factory_input_dto = NewContentFactoryInputDto(contentType)
-    new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter())
+    new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter(args.path))
     new_content = NewContent()
     new_content.execute(new_content_input_dto)
 
@@ -256,9 +256,9 @@ def reporting(args) -> None:
         SecurityContentStoryBuilder(),
         SecurityContentBaselineBuilder(),
         SecurityContentInvestigationBuilder(),
-        SecurityContentPlaybookBuilder(),
+        SecurityContentPlaybookBuilder(input_path=args.path),
         SecurityContentDirector(),
-        AttackEnrichment.get_attack_lookup(force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
+        AttackEnrichment.get_attack_lookup(args.path, force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
     )
 
     reporting_input_dto = ReportingInputDto(

dist/escu/default/analyticstories.conf

@@ -10588,7 +10588,7 @@ narrative = Ransomware is an ever-present risk to the enterprise, wherein an inf
 category = Malware
 last_updated = 2021-05-12
 version = 1
-references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
+references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
 searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Windows Possible Credential Dumping - Rule"]

docs/_posts/2021-02-22-cobalt_strike_named_pipes.md

@@ -151,7 +151,7 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
 * [https://www.cobaltstrike.com/help-smb-beacon](https://www.cobaltstrike.com/help-smb-beacon)
 * [https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/](https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/)
 * [https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752](https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 
 
 

docs/_posts/2021-12-03-detect_rclone_command-line_usage.md

@@ -94,7 +94,7 @@ Note that risk score is calculated base on the following formula: `(Impact * Con
 #### Reference
 
 * [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 * [https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/)
 * [https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/](https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/)
 

docs/_stories/darkside_ransomware.md

@@ -53,7 +53,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 #### Reference
 
 * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 
 
 

docs/detections.wiki

@@ -12939,7 +12939,7 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
 
 * https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 
 
@@ -15515,7 +15515,7 @@ unknown
 ====Reference====
 
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 * https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
 
@@ -18537,7 +18537,7 @@ There is potential for false positives as these arguments may be used by other a
 
 * https://redcanary.com/blog/rclone-mega-extortion/
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 * https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 
@@ -19607,7 +19607,7 @@ False positives should be limited as this analytic identifies renamed instances
 
 * https://redcanary.com/blog/rclone-mega-extortion/
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 * https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 
@@ -26428,7 +26428,7 @@ It is possible some agent based products will generate false positives. Filter a
 ====Reference====
 
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 * https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
 
@@ -45080,7 +45080,7 @@ Limited false positives should be present as this is not commonly used by legiti
 
 * https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 
 
@@ -45175,7 +45175,7 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi
 
 * https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 
 

docs/stories.wiki

@@ -12401,7 +12401,7 @@ Privilege Escalation, Defense Evasion
 
 * https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
 
-* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+* https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 
 
 ''version'': 1

stories/disabling_security_tools.yml

@@ -19,7 +19,7 @@ narrative: Attackers employ a variety of tactics in order to avoid detection and
 references:
 - https://attack.mitre.org/wiki/Technique/T1089
 - https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/
-- https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf
+- https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf
 tags:
   analytic_story: Disabling Security Tools
   category:

stories/hidden_cobra_malware.yml

@@ -36,7 +36,7 @@ narrative: 'North Korea''s government-sponsored "cyber army" has been slowly bui
   activity that indicates that malware is sending email back to the attackers.'
 references:
 - https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
-- https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
+- https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
 tags:
   analytic_story: Hidden Cobra Malware
   category:

stories/ransomware_darkside.yml

@@ -16,7 +16,7 @@ narrative: This story addresses Darkside ransomware. This ransomware payload has
   to other ransomware payloads and those particular to Darkside payload.
 references:
 - https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
 tags:
   analytic_story: DarkSide Ransomware
   category: