From 4a9ce127390272408ec18140243588d9ec39b710 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 17 Apr 2023 15:00:26 -0700 Subject: [PATCH 1/6] adding risk=other to all configs --- .../builder/security_content_detection_builder.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 7ceb80358e..260aff771a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -85,12 +85,17 @@ class SecurityContentDetectionBuilder(DetectionBuilder): risk_object['risk_object_field'] = entity['name'] risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) - else: + elif 'Attacker' in (entity['role']): risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() + risk_objects.append(risk_object) + else: + risk_object['risk_object_type'] = 'other' + risk_object['risk_object_field'] = entity['name'] + risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) continue - + if self.security_content_obj.tags.risk_score >= 80: self.security_content_obj.tags.risk_severity = 'high' elif (self.security_content_obj.tags.risk_score >= 50 and self.security_content_obj.tags.risk_score <= 79): From fc34672ca42062d24abaad3b8dea8c78e93114da Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 17 Apr 2023 15:23:53 -0700 Subject: [PATCH 2/6] updates to ymls --- .../builder/security_content_detection_builder.py | 4 +++- ...hreatinsight_login_failure_with_high_unknown_users.yml | 6 +++++- .../okta_threatinsight_suspected_passwordspray_attack.yml | 8 ++++++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 260aff771a..0a1e764a50 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -85,9 +85,11 @@ class SecurityContentDetectionBuilder(DetectionBuilder): risk_object['risk_object_field'] = entity['name'] risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) + elif 'Attacker' in (entity['role']): risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() + risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) else: risk_object['risk_object_type'] = 'other' @@ -95,7 +97,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) continue - + if self.security_content_obj.tags.risk_score >= 80: self.security_content_obj.tags.risk_severity = 'high' elif (self.security_content_obj.tags.risk_score >= 50 and self.security_content_obj.tags.risk_score <= 79): diff --git a/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml b/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml index 0b994a32b3..77e7b38882 100644 --- a/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml +++ b/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml @@ -27,7 +27,11 @@ tags: - T1078 - T1078.001 - T1110.004 - observable: [] + observable: + - name: outcome.reason + type: Other + role: + - Other product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml b/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml index 33d3fa46a7..19eb2a6532 100644 --- a/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml +++ b/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml @@ -27,13 +27,17 @@ tags: - T1078 - T1078.001 - T1110.003 - observable: [] + observable: + - name: outcome.reason + type: Other + role: + - Other product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - _times - eventType - client.userAgent.rawUserAgent - client.userAgent.browser From 932b49ccfd25ba99bb83dd3ca2bfb711632d2008 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 17 Apr 2023 16:06:37 -0700 Subject: [PATCH 3/6] fixes to validate --- .../builder/security_content_detection_builder.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 0a1e764a50..510d27162f 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -73,6 +73,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'): for entity in self.security_content_obj.tags.observable: + risk_object = dict() if entity['type'].lower() in risk_object_user_types: risk_object['risk_object_type'] = 'user' @@ -86,10 +87,9 @@ class SecurityContentDetectionBuilder(DetectionBuilder): risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) - elif 'Attacker' in (entity['role']): + elif 'role' in entity and 'Attacker' in entity['role']: risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() - risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) else: risk_object['risk_object_type'] = 'other' From 69296ac7d1e112242fe3a85868eef5f3be06b131 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 17 Apr 2023 16:46:08 -0700 Subject: [PATCH 4/6] Update okta_threatinsight_suspected_passwordspray_attack.yml --- .../okta_threatinsight_suspected_passwordspray_attack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml b/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml index 19eb2a6532..beafccd044 100644 --- a/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml +++ b/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml @@ -37,7 +37,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _times + - _time - eventType - client.userAgent.rawUserAgent - client.userAgent.browser From dc44d23e815c079231a9cf24ea76daa92db0a7fc Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 17 Apr 2023 17:19:11 -0700 Subject: [PATCH 5/6] issue 2568 fix --- .../network/dns_query_length_with_high_standard_deviation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index b2b7b508a5..e579b3b945 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -10,9 +10,9 @@ description: This search allows you to identify DNS requests and compute the sta standard deviation to show you those queries that are unusually large for your environment. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution - where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` + where NOT DNS.message_type IN("Pointer","PTR") by DNS.query host| `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) - | search tld_len<=24 | eval query_length = len(query) | table query query_length + | search tld_len<=24 | eval query_length = len(query) | table host query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter`' From a9c33e7702347aeceee8fff019d93a511caa1723 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 18 Apr 2023 09:53:16 -0700 Subject: [PATCH 6/6] fixing observables --- ..._cross_account_activity_from_previously_unseen_account.yml | 4 ++-- .../network/multiple_archive_files_http_post_traffic.yml | 2 +- detections/network/plain_http_post_exfiltrated_data.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index dac9b6a373..6f5650ec52 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -42,8 +42,8 @@ tags: type: Other role: - Attacker - - name: requestedAccountId - type: Other + - name: user + type: User role: - Victim product: diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index feabc206d7..e2683c2744 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -51,7 +51,7 @@ tags: - name: form_data type: Other role: - - Attacker + - Other product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index b8b0b71333..20753d905b 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -41,7 +41,7 @@ tags: - name: form_data type: Other role: - - Attacker + - Other product: - Splunk Enterprise - Splunk Enterprise Security