splunk-security_content/docs/detections.spec.json

{
    "$id": "http://example.com/example.json",
    "$schema": "http://json-schema.org/draft-07/schema",
    "additionalProperties": true,
    "description": "schema for detections",
    "properties": {
        "author": {
            "$id": "#/properties/author",
            "default": "",
            "description": "Author of the detection",
            "examples": [
                "Patrick Bareiss, Splunk"
            ],
            "type": "string"
        },
        "date": {
            "$id": "#/properties/date",
            "default": "",
            "description": "date of creation or modification, format yyyy-mm-dd",
            "examples": [
                "2019-12-06"
            ],
            "type": "string"
        },
        "description": {
            "$id": "#/properties/description",
            "default": "",
            "description": "A detailed description of the detection",
            "examples": [
                "dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump."
            ],
            "type": "string"
        },
        "how_to_implement": {
            "$id": "#/properties/how_to_implement",
            "default": "",
            "description": "information about how to implement. Only needed for non standard implementations.",
            "examples": [
                "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
            ],
            "type": "string"
        },
        "id": {
            "$id": "#/properties/id",
            "default": "",
            "description": "UUID as unique identifier",
            "examples": [
                "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
            ],
            "type": "string"
        },
        "known_false_positives": {
            "$id": "#/properties/knwon_false_positives",
            "default": "",
            "description": "known false postives",
            "examples": [
                "Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual."
            ],
            "type": "string"
        },
        "name": {
            "$id": "#/properties/name",
            "default": "",
            "examples": [
                "Access LSASS Memory for Dump Creation"
            ],
            "title": "Name of detection",
            "type": "string"
        },
        "references": {
            "$id": "#/properties/references",
            "additionalItems": true,
            "default": [],
            "description": "A list of references for this detection",
            "examples": [
                [
                    "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
                ]
            ],
            "items": {
                "$id": "#/properties/references/items",
                "default": "",
                "description": "An explanation about the purpose of this instance.",
                "examples": [
                    "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
                ],
                "title": "The Items Schema",
                "type": "string"
            },
            "type": "array"
        },
        "search": {
            "$id": "#/properties/search",
            "default": "",
            "description": "The Splunk search for the detection",
            "examples": [
                "`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`"
            ],
            "type": "string"
        },
        "tags": {
            "$id": "#/properties/tags",
            "additionalProperties": true,
            "default": {},
            "description": "An array of key value pairs for tagging",
            "examples": [
                {
                    "analytics_story": "credential_dumping",
                    "kill_chain_phases": "Action on Objectives",
                    "mitre_attack_id": "T1078.004",
                    "cis20": "CIS 13",
                    "nist": "DE.DP",
                    "security domain": "network",
                    "asset_type": "AWS Instance",
                    "risk_object": "user",
                    "risk_object_type": "network_artifacts",
                    "risk score": "60",
                    "custom_key": "custom_value"
                }
            ],
            "minItems": 1,
            "type": "object",
            "uniqueItems": true
        },
        "type": {
            "$id": "#/properties/type",
            "default": "",
            "description": "type of detection",
            "examples": [
                "ESCU"
            ],
            "items": {
                "enum": [
                    "ESCU",
                    "SSE",
                    "RBA"
                ],
                "type": "string"
            },
            "type": "string"
        },
        "version": {
            "$id": "#/properties/version",
            "default": 0,
            "description": "version of detection, e.g. 1 or 2 ...",
            "examples": [
                2
            ],
            "type": "integer"
        }
    },
    "required": [
        "name",
        "id",
        "version",
        "date",
        "description",
        "type",
        "author",
        "search",
        "known_false_positives",
        "tags"
    ],
    "title": "Detection Schema",
    "type": "object"
}