[BUG] Elevated Group Discovery with PowerView: the test sample windows-xml.log is declared as Sysmon but holds Security events

未关闭 适合新手
  • 哪里不对？
#4,418 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
1/5
预计耗时
1 小时以内
新手友好度
78/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
powershell, yaml
领域
security, testing-qa

调研方向

从 detections/endpoint/elevated_group_discovery_with_powerview.yml 的 tests 代码块开始，将第二个 attack_data 条目与 datasets/attack_techniques/T1069.002/AD_discovery/AD_discovery.yml 中的 descriptor 进行比较，该 descriptor 将 windows-xml.log 声明为 XmlWinEventLog:Security。在 windows-xml.log 上运行 issue 中的 grep 命令，确认它只包含 Security 5145 事件。完成的标准是：第二个样本的来源与 Security 一致，或者由于规则搜索的是事件 4104 而文件中没有该事件，因此删除该样本。编辑前请先确认维护者倾向哪个选项。

由索引模型根据 Issue 内容生成。

描述

bug
Describe the bug

In the tests block of detections/endpoint/elevated_group_discovery_with_powerview.yml (id 10d62950-0de5-4199-a710-cff9ea79b413, version 11), the second sample is declared as a Sysmon log. The file holds Security events, and the descriptor in attack_data says so.

tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview.log
          source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
          sourcetype: XmlWinEventLog
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-xml.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog

The file datasets/attack_techniques/T1069.002/AD_discovery/windows-xml.log holds 8 events. All 8 are Security event 5145 (a network share object was checked), on the Security channel. The file has no mention of the Sysmon provider.

$ grep -o '<Channel>[^<]*</Channel>' windows-xml.log | sort | uniq -c
      8 <Channel>Security</Channel>
$ grep -o '<EventID>[0-9]*</EventID>' windows-xml.log | sort | uniq -c
      8 <EventID>5145</EventID>

The descriptor datasets/attack_techniques/T1069.002/AD_discovery/AD_discovery.yml in attack_data declares the same file as XmlWinEventLog:Security:

- name: windows-xml
  path: /datasets/attack_techniques/T1069.002/AD_discovery/windows-xml.log
  sourcetype: XmlWinEventLog
  source: XmlWinEventLog:Security

The rule itself searches PowerShell script block logging (powershell macro, EventCode=4104, data_source: Powershell Script Block Logging 4104). The first sample, windows-powershell-xml-powerview.log, holds 15 events, all 4104 on Microsoft-Windows-PowerShell/Operational. The second sample holds no event 4104.

Expected behavior

The source of each sample should name the log the file holds. For windows-xml.log that is XmlWinEventLog:Security.

Suggested change: change the source of the second sample to XmlWinEventLog:Security. Or remove the second sample, because the rule searches event 4104 and the file holds none.

Screenshots

None.

App Version:
  • ESCU: 6.10.0 (the tests block is the same in release v6.10.0 and on develop)
  • Splunk Security Essentials: Not applicable
Additional context

None.

主要语言
Python
星标
1.7k
派生
507
平均合并
2 天 17 小时
30 天内合并 PR
35

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

splunk/security_content 的其他 Issue

查看 splunk/security_content 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。