mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
411 lines
10 KiB
Markdown
411 lines
10 KiB
Markdown
# Detection Schema Schema
|
|
|
|
```txt
|
|
http://example.com/example.json
|
|
```
|
|
|
|
schema for detections
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|
|
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :----------------------------------------------------------------------------- |
|
|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [detections.spec.json](../../spec/detections.spec.json "open original schema") |
|
|
|
|
## Detection Schema Type
|
|
|
|
`object` ([Detection Schema](detections.md))
|
|
|
|
# Detection Schema Properties
|
|
|
|
| Property | Type | Required | Nullable | Defined by |
|
|
| :---------------------------------------------- | :-------- | :------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| [author](#author) | `string` | Required | cannot be null | [Detection Schema](detections-properties-author.md "#/properties/author#/properties/author") |
|
|
| [date](#date) | `string` | Required | cannot be null | [Detection Schema](detections-properties-date.md "#/properties/date#/properties/date") |
|
|
| [description](#description) | `string` | Required | cannot be null | [Detection Schema](detections-properties-description.md "#/properties/description#/properties/description") |
|
|
| [how_to_implement](#how_to_implement) | `string` | Optional | cannot be null | [Detection Schema](detections-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement") |
|
|
| [id](#id) | `string` | Required | cannot be null | [Detection Schema](detections-properties-id.md "#/properties/id#/properties/id") |
|
|
| [known_false_positives](#known_false_positives) | `string` | Required | cannot be null | [Detection Schema](detections-properties-known_false_positives.md "#/properties/knwon_false_positives#/properties/known_false_positives") |
|
|
| [name](#name) | `string` | Required | cannot be null | [Detection Schema](detections-properties-name-of-detection.md "#/properties/name#/properties/name") |
|
|
| [references](#references) | `array` | Optional | cannot be null | [Detection Schema](detections-properties-references.md "#/properties/references#/properties/references") |
|
|
| [search](#search) | `string` | Required | cannot be null | [Detection Schema](detections-properties-search.md "#/properties/search#/properties/search") |
|
|
| [tags](#tags) | `object` | Required | cannot be null | [Detection Schema](detections-properties-tags.md "#/properties/tags#/properties/tags") |
|
|
| [type](#type) | `string` | Required | cannot be null | [Detection Schema](detections-properties-type.md "#/properties/type#/properties/type") |
|
|
| [datamodel](#datamodel) | `array` | Optional | cannot be null | [Detection Schema](detections-properties-datamodel.md "#/properties/datamodel#/properties/datamodel") |
|
|
| [version](#version) | `integer` | Required | cannot be null | [Detection Schema](detections-properties-version.md "#/properties/version#/properties/version") |
|
|
| Additional Properties | Any | Optional | can be null | |
|
|
|
|
## author
|
|
|
|
Author of the detection
|
|
|
|
`author`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-author.md "#/properties/author#/properties/author")
|
|
|
|
### author Type
|
|
|
|
`string`
|
|
|
|
### author Examples
|
|
|
|
```yaml
|
|
Patrick Bareiss, Splunk
|
|
|
|
```
|
|
|
|
## date
|
|
|
|
date of creation or modification, format yyyy-mm-dd
|
|
|
|
`date`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-date.md "#/properties/date#/properties/date")
|
|
|
|
### date Type
|
|
|
|
`string`
|
|
|
|
### date Examples
|
|
|
|
```yaml
|
|
'2019-12-06'
|
|
|
|
```
|
|
|
|
## description
|
|
|
|
A detailed description of the detection
|
|
|
|
`description`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-description.md "#/properties/description#/properties/description")
|
|
|
|
### description Type
|
|
|
|
`string`
|
|
|
|
### description Examples
|
|
|
|
```yaml
|
|
>-
|
|
dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain
|
|
a memory dump of a process. This search detects the usage of this DLL for
|
|
creating a memory dump of LSASS process. Memory dumps of the LSASS process can
|
|
be created with tools such as Windows Task Manager or procdump.
|
|
|
|
```
|
|
|
|
## how_to_implement
|
|
|
|
information about how to implement. Only needed for non standard implementations.
|
|
|
|
`how_to_implement`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement")
|
|
|
|
### how_to_implement Type
|
|
|
|
`string`
|
|
|
|
### how_to_implement Examples
|
|
|
|
```yaml
|
|
>-
|
|
This search requires Sysmon Logs and a Sysmon configuration, which includes
|
|
EventCode 10 for lsass.exe.
|
|
|
|
```
|
|
|
|
## id
|
|
|
|
UUID as unique identifier
|
|
|
|
`id`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-id.md "#/properties/id#/properties/id")
|
|
|
|
### id Type
|
|
|
|
`string`
|
|
|
|
### id Examples
|
|
|
|
```yaml
|
|
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
|
|
|
|
```
|
|
|
|
## known_false_positives
|
|
|
|
known false postives
|
|
|
|
`known_false_positives`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-known_false_positives.md "#/properties/knwon_false_positives#/properties/known_false_positives")
|
|
|
|
### known_false_positives Type
|
|
|
|
`string`
|
|
|
|
### known_false_positives Examples
|
|
|
|
```yaml
|
|
>-
|
|
Administrators can create memory dumps for debugging purposes, but memory
|
|
dumps of the LSASS process would be unusual.
|
|
|
|
```
|
|
|
|
## name
|
|
|
|
|
|
|
|
`name`
|
|
|
|
* is required
|
|
|
|
* Type: `string` ([Name of detection](detections-properties-name-of-detection.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-name-of-detection.md "#/properties/name#/properties/name")
|
|
|
|
### name Type
|
|
|
|
`string` ([Name of detection](detections-properties-name-of-detection.md))
|
|
|
|
### name Examples
|
|
|
|
```yaml
|
|
Access LSASS Memory for Dump Creation
|
|
|
|
```
|
|
|
|
## references
|
|
|
|
A list of references for this detection
|
|
|
|
`references`
|
|
|
|
* is optional
|
|
|
|
* Type: `string[]` ([The Items Schema](detections-properties-references-the-items-schema.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-references.md "#/properties/references#/properties/references")
|
|
|
|
### references Type
|
|
|
|
`string[]` ([The Items Schema](detections-properties-references-the-items-schema.md))
|
|
|
|
### references Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
[]
|
|
```
|
|
|
|
### references Examples
|
|
|
|
```yaml
|
|
- >-
|
|
https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
|
|
|
|
```
|
|
|
|
## search
|
|
|
|
The Splunk search for the detection
|
|
|
|
`search`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-search.md "#/properties/search#/properties/search")
|
|
|
|
### search Type
|
|
|
|
`string`
|
|
|
|
### search Examples
|
|
|
|
```yaml
|
|
>-
|
|
`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR
|
|
CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as
|
|
lastTime by Computer, TargetImage, TargetProcessId, SourceImage,
|
|
SourceProcessId | rename Computer as dest |
|
|
`security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |
|
|
`access_lsass_memory_for_dump_creation_filter`
|
|
|
|
```
|
|
|
|
## tags
|
|
|
|
An array of key value pairs for tagging
|
|
|
|
`tags`
|
|
|
|
* is required
|
|
|
|
* Type: `object` ([Details](detections-properties-tags.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-tags.md "#/properties/tags#/properties/tags")
|
|
|
|
### tags Type
|
|
|
|
`object` ([Details](detections-properties-tags.md))
|
|
|
|
### tags Constraints
|
|
|
|
**minimum number of items**: the minimum number of items for this array is: `1`
|
|
|
|
**unique items**: all items in this array must be unique. Duplicates are not allowed.
|
|
|
|
### tags Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
### tags Examples
|
|
|
|
```yaml
|
|
analytic_story: credential_dumping
|
|
kill_chain_phases: Action on Objectives
|
|
mitre_attack_id: T1078.004
|
|
cis20: CIS 13
|
|
nist: DE.DP
|
|
security domain: network
|
|
asset_type: AWS Instance
|
|
risk_object: user
|
|
risk_object_type: network_artifacts
|
|
risk score: '60'
|
|
custom_key: custom_value
|
|
|
|
```
|
|
|
|
## type
|
|
|
|
type of detection
|
|
|
|
`type`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-type.md "#/properties/type#/properties/type")
|
|
|
|
### type Type
|
|
|
|
`string`
|
|
|
|
### type Examples
|
|
|
|
```yaml
|
|
streaming
|
|
|
|
```
|
|
|
|
## datamodel
|
|
|
|
datamodel used in the search
|
|
|
|
`datamodel`
|
|
|
|
* is optional
|
|
|
|
* Type: `string[]`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-datamodel.md "#/properties/datamodel#/properties/datamodel")
|
|
|
|
### datamodel Type
|
|
|
|
`string[]`
|
|
|
|
### datamodel Examples
|
|
|
|
```yaml
|
|
Endpoint
|
|
|
|
```
|
|
|
|
## version
|
|
|
|
version of detection, e.g. 1 or 2 ...
|
|
|
|
`version`
|
|
|
|
* is required
|
|
|
|
* Type: `integer`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Detection Schema](detections-properties-version.md "#/properties/version#/properties/version")
|
|
|
|
### version Type
|
|
|
|
`integer`
|
|
|
|
### version Examples
|
|
|
|
```yaml
|
|
2
|
|
|
|
```
|
|
|
|
## Additional Properties
|
|
|
|
Additional properties are allowed and do not have to follow a specific schema
|