From edb111c9b951632afc380c2ea4b034d804021bb7 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 17 Feb 2023 17:53:51 +0100 Subject: [PATCH] update --- .../adapter/templates/finding_report.j2 | 4 +-- .../builder/backend_splunk_ba.py | 12 +++++---- ...ssa___anomalous_usage_of_archive_tools.yml | 26 ++++++++++--------- ...dential_dump_from_registry_via_reg_exe.yml | 4 +-- ...ssa___anomalous_usage_of_archive_tools.yml | 22 +++++++++------- 5 files changed, 37 insertions(+), 31 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index f3cdedd3ef..ad02f8b4d3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -10,7 +10,7 @@ "confidence_id", {{ detection.tags.confidence_id }}, "devices", [ create_map( - "uid", ucast(map_get( dest_device , "ref_uid"), "string", null), "type_id", 0) + "uid", device_uuid, "type_id", 0) ], "duration", 0, "time", timestamp, @@ -40,7 +40,7 @@ "type_id", 10200101, "users", [ create_map( - "uid", ucast(map_get(dest_user, "ref_uid"),"string", null) + "uid", inferred_caller_user_uid ) ] ) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index 65d81940ea..08224e8b98 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -92,11 +92,13 @@ class SplunkBABackend(TextQueryBackend): | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval disposition_id = ucast(map_get(input_event, "disposition_id"), "integer", null) -| eval origin_map=ucast(map_get(input_event, "origin"), "map", null) -| eval device=ucast(map_get(origin_map, "device"), "map",null) -| eval user=ucast(map_get(input_event, "user"), "map", null) -| eval device_name=ucast(map_get(device, "name"), "string", null) -| eval user_name=ucast(map_get(user,"name"), "string", null) +| eval device = ucast(map_get(input_event, "device"), "map", null) +| eval device_hostname = ucast(map_get(device, "hostname"), "string", null) +| eval device_uuid = ucast(map_get(device, "uuid"), "string", null) +| eval inferred = ucast(map_get(input_event, "device"), "map", null) +| eval inferred_caller = ucast(map_get(inferred, "caller"), "map", null) +| eval inferred_caller_user = ucast(map_get(inferred_caller, "user"), "map", null) +| eval inferred_caller_user_uid = ucast(map_get(inferred_caller_user, "uid"), "string", null) """.replace("\n", " ") parsed_fields = [] diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index f094724d8c..461d3677fa 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -7,16 +7,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval disposition_id = ucast(map_get(input_event, "disposition_id"), "integer", null) - | eval origin_map=ucast(map_get(input_event, "origin"), "map", null) - | eval device=ucast(map_get(origin_map, "device"), "map",null) | eval - user=ucast(map_get(input_event, "user"), "map", null) | eval device_name=ucast(map_get(device, - "name"), "string", null) | eval user_name=ucast(map_get(user,"name"), "string", - null) | eval process=ucast(map_get(input_event,"process"), "map", null) - | eval process_file=ucast(map_get(process,"file"), "map", null) | eval - process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), - "map", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + | eval device = ucast(map_get(input_event, "device"), "map", null) | + eval device_hostname = ucast(map_get(device, "hostname"), "string", null) | eval + device_uuid = ucast(map_get(device, "uuid"), "string", null) | eval inferred = ucast(map_get(input_event, + "device"), "map", null) | eval inferred_caller = ucast(map_get(inferred, + "caller"), "map", null) | eval inferred_caller_user = ucast(map_get(inferred_caller, + "user"), "map", null) | eval inferred_caller_user_uid = ucast(map_get(inferred_caller_user, + "uid"), "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval actor=ucast(map_get(input_event,"actor"), "map", null) | eval + actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_file=ucast(map_get(actor_process,"file"), + "map", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "map", null) | where process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") @@ -33,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "confidence_id", 2, "devices", [ create_map( - "uid", ucast(map_get( dest_device , "ref_uid"), "string", null), "type_id", 0) + "uid", device_uuid, "type_id", 0) ], "duration", 0, "time", timestamp, @@ -63,7 +65,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "type_id", 10200101, "users", [ create_map( - "uid", ucast(map_get(dest_user, "ref_uid"),"string", null) + "uid", inferred_caller_user_uid ) ] ) diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 52f7bfbc7f..22f4c5bdff 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "confidence_id", 3, "devices", [ create_map( - "uid", ucast(map_get( dest_device , "ref_uid"), "string", null), "type_id", 0) + "uid", device_uuid, "type_id", 0) ], "duration", 0, "time", timestamp, @@ -69,7 +69,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "type_id", 10200101, "users", [ create_map( - "uid", ucast(map_get(dest_user, "ref_uid"),"string", null) + "uid", inferred_caller_user_uid ) ] ) diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 1a9255a851..6625a8ab15 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -13,16 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval disposition_id = ucast(map_get(input_event, "disposition_id"), "integer", null) - | eval origin_map=ucast(map_get(input_event, "origin"), "map", null) - | eval device=ucast(map_get(origin_map, "device"), "map",null) | eval - user=ucast(map_get(input_event, "user"), "map", null) | eval device_name=ucast(map_get(device, - "name"), "string", null) | eval user_name=ucast(map_get(user,"name"), "string", - null) | eval process=ucast(map_get(input_event,"process"), "map", null) - | eval process_file=ucast(map_get(process,"file"), "map", null) | eval - process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), - "map", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + | eval device = ucast(map_get(input_event, "device"), "map", null) | + eval device_hostname = ucast(map_get(device, "hostname"), "string", null) | eval + device_uuid = ucast(map_get(device, "uuid"), "string", null) | eval inferred = ucast(map_get(input_event, + "device"), "map", null) | eval inferred_caller = ucast(map_get(inferred, + "caller"), "map", null) | eval inferred_caller_user = ucast(map_get(inferred_caller, + "user"), "map", null) | eval inferred_caller_user_uid = ucast(map_get(inferred_caller_user, + "uid"), "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval actor=ucast(map_get(input_event,"actor"), "map", null) | eval + actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_file=ucast(map_get(actor_process,"file"), + "map", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "map", null) | where process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")