Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-03-18 07:04:26 -07:00
parent be36e4b95a 918090cc4d
commit e87dca3aa5
46 changed files with 52 additions and 13 deletions
@@ -47,6 +47,7 @@ class ObjToYmlAdapter(Adapter):
                                "kill_chain_phases": True,
                                "mitre_attack_id": True,
                                "risk_severity": True,
+                                "risk_score": True,
                                "security_domain": True,
                                "required_fields": True
                            },
@@ -50,6 +50,7 @@ tags:
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
+  risk_score: 42
  security_domain: endpoint
  risk_severity: low
 test:
@@ -50,6 +50,7 @@ tags:
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
+  risk_score: 42
  security_domain: endpoint
  risk_severity: low
 test:
@@ -65,6 +65,7 @@ tags:
  - dest_user_id
  - dest_device_id
  - authentication_method
+  risk_score: 72
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -66,6 +66,7 @@ tags:
  - dest_user_id
  - origin_device_id
  - authentication_method
+  risk_score: 64
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -63,6 +63,7 @@ tags:
  - dest_device_id
  - _time
  - process_name
+  risk_score: 25
  security_domain: endpoint
  risk_severity: low
 test:
@@ -12,18 +12,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
  IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%")
  OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
-  "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", start_time, 
-  "detection_end_time", end_time, "device_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.device_entities.device.uid"), "string", null), "type_id", 0)], 
-  "disposition_id", 1, "end_time", end_time, "event_id", 10100001, "event_time", timestamp, 
-  "finding", create_map("confidence", 60, "confidence_id", 2, 
-  "context_ids", [10, 49], "impact", 70, "impact_id", 4,
-  "kill_chain_phase", Exploitation, "kill_chain_phase_id", 4, 
-  "risk_level", Medium, "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id), 
-  "message", An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip., "metadata", create_map("log_name", Endpoint_Processes, "version",
-  "1.0.0"), "observables", , "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), 
-  "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", start_time,
-  "user_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.user_entities.user.uid"),"string", null))])
-  | into write_ssa_finding_events();'
+  "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
+  parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -50,6 +43,7 @@ tags:
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
+  risk_score: 42
  security_domain: endpoint
  risk_severity: low
 test:
@@ -52,6 +52,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 36
  security_domain: endpoint
  risk_severity: low
 test:
@@ -51,6 +51,7 @@ tags:
  - process_path
  - dest_user_id
  - process
+  risk_score: 36
  security_domain: endpoint
  risk_severity: low
 test:
@@ -47,6 +47,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 63
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -44,6 +44,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -51,6 +51,7 @@ tags:
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
+  risk_score: 90
  security_domain: endpoint
  risk_severity: high
 test:
@@ -50,6 +50,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 49
  security_domain: endpoint
  risk_severity: low
 test:
@@ -47,6 +47,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -41,6 +41,7 @@ tags:
  - _time
  - dest_device_id
  - process
+  risk_score: 70
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -49,6 +49,7 @@ tags:
  - dest_device_id
  - dest_user_id
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -54,6 +54,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -51,6 +51,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 49
  security_domain: endpoint
  risk_severity: low
 test:
@@ -34,8 +34,8 @@ tags:
  analytic_story:
  - Suspicious DNS Traffic
  - Dynamic DNS
-  - Command & Control
  - Data Exfiltration
+  - Command and Control
  cis20: []
  kill_chain_phases:
  - Exploitation
@@ -51,6 +51,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 72
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -43,6 +43,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 54
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -47,6 +47,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -44,6 +44,7 @@ tags:
  - PR.IP
  required_fields:
  - _time
+  risk_score: 72
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -50,6 +50,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -50,6 +50,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 64
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -59,6 +59,7 @@ tags:
  - process_id
  - process_path
  - cmd_line
+  risk_score: 42
  security_domain: endpoint
  risk_severity: low
 test:
@@ -246,6 +246,7 @@ tags:
  - _time
  - dest_user_id
  - process_path
+  risk_score: 56
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -48,6 +48,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: network
  risk_severity: low
 test:
@@ -48,6 +48,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 15
  security_domain: endpoint
  risk_severity: low
 test:
@@ -52,6 +52,7 @@ tags:
  - process_path
  - dest_user_id
  - process
+  risk_score: 63
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -48,6 +48,7 @@ tags:
  - process_path
  - dest_user_id
  - process
+  risk_score: 63
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -55,6 +55,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 56
  security_domain: endpoint
  risk_severity: medium
 test:
@@ -59,6 +59,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 49
  security_domain: endpoint
  risk_severity: low
 test:
@@ -53,6 +53,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 40
  security_domain: endpoint
  risk_severity: low
 test:
@@ -50,6 +50,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 90
  security_domain: endpoint
  risk_severity: high
 test:
@@ -51,6 +51,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 90
  security_domain: endpoint
  risk_severity: high
 test:
@@ -62,6 +62,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -47,6 +47,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 49
  security_domain: endpoint
  risk_severity: low
 test:
@@ -56,6 +56,7 @@ tags:
  - registry_value_type
  - registry_value_data
  - process_guid
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -53,6 +53,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -55,6 +55,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -53,6 +53,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -62,6 +62,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -55,6 +55,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 35
  security_domain: endpoint
  risk_severity: low
 test:
@@ -51,6 +51,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 49
  security_domain: endpoint
  risk_severity: low
 test:
@@ -51,6 +51,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 80
  security_domain: endpoint
  risk_severity: high
 test:
@@ -56,6 +56,7 @@ tags:
  - dest_user_id
  - process
  - cmd_line
+  risk_score: 56
  security_domain: endpoint
  risk_severity: medium
 test: