From 54353b7a46e9e722655e485751161eb6c88e24bc Mon Sep 17 00:00:00 2001 From: admingit Date: Sun, 22 Oct 2023 20:42:45 +0200 Subject: [PATCH] up --- .../default/indexes.conf | 2 + deployment-apps/TA-microsoft-sysmon/.DS_Store | Bin 0 -> 6148 bytes deployment-apps/TA-microsoft-sysmon/LICENSE | 201 +++++++++++++ deployment-apps/TA-microsoft-sysmon/README.md | 274 ++++++++++++++++++ .../TA-microsoft-sysmon/default/app.conf | 15 + .../default/eventtypes.conf | 17 ++ .../TA-microsoft-sysmon/default/inputs.conf | 7 + .../TA-microsoft-sysmon/default/props.conf | 72 +++++ .../TA-microsoft-sysmon/default/tags.conf | 28 ++ .../default/transforms.conf | 103 +++++++ .../default/workflow_actions.conf | 47 +++ .../TA-microsoft-sysmon/local/inputs.conf | 8 + .../TA-microsoft-sysmon/lookups/eventcode.csv | 24 ++ .../TA-microsoft-sysmon/metadata/default.meta | 19 ++ .../TA-microsoft-sysmon/splunkbase.manifest | 115 ++++++++ .../TA-microsoft-sysmon/static/appIcon.png | Bin 0 -> 1736 bytes .../TA-microsoft-sysmon/static/appIcon_2x.png | Bin 0 -> 4774 bytes 17 files changed, 932 insertions(+) create mode 100644 deployment-apps/TA-microsoft-sysmon/.DS_Store create mode 100644 deployment-apps/TA-microsoft-sysmon/LICENSE create mode 100644 deployment-apps/TA-microsoft-sysmon/README.md create mode 100644 deployment-apps/TA-microsoft-sysmon/default/app.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/default/eventtypes.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/default/inputs.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/default/props.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/default/tags.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/default/transforms.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/default/workflow_actions.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/local/inputs.conf create mode 100644 deployment-apps/TA-microsoft-sysmon/lookups/eventcode.csv create mode 100644 deployment-apps/TA-microsoft-sysmon/metadata/default.meta create mode 100644 deployment-apps/TA-microsoft-sysmon/splunkbase.manifest create mode 100644 deployment-apps/TA-microsoft-sysmon/static/appIcon.png create mode 100644 deployment-apps/TA-microsoft-sysmon/static/appIcon_2x.png diff --git a/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf b/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf index 821331f5..98f0f57c 100644 --- a/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf +++ b/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf @@ -17,6 +17,8 @@ suspendHotRollByDeleteQuery = 0 syncMeta = 1 maxTotalDataSizeMB = 5000 +[sysmon] + [idx_m-tic_windows] [idx_m-tic_fortigate] diff --git a/deployment-apps/TA-microsoft-sysmon/.DS_Store b/deployment-apps/TA-microsoft-sysmon/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..0f328807bfbfaa6628ff7fa508af1395b03e545c GIT binary patch literal 6148 zcmeHKJ5EC}5S)cbM50NV(pTUHRuoRa1^7Iuo|FR8zlw9^Xv}^Jq6b}4B$}1hW3P8? zd5X7h0oZ0gJOC>IOS&VzeVCi?yU*;VB1WY1j6Ftt4WDo0>u#3)cfh%K81Rk{y!__x zM&FW20VyB_q<|EV0w-3W3heU!#OLZbDIf(dUjhFH!68}z;)3BY&ZCzg zHV+Vc;grY-&5}w?s#S|&NoTxOUN4*ylMbuq!|G + +## 10.6.1 + +* March 6, 2020 +* + +## 10.5.0 + +* March 3, 2020 +* +* Reverted change to source (XmlWinEventLog...), added source specification in inputs.conf to remeove dependancy on Splunk_TA_windows + +## 10.4.0 + +* March 2, 2020 +* Tested with Sysmon version 10 +* +* Updated props.conf + +## 10.3.0 + +* February 20, 2020 +* Tested with Sysmon version 10 +* +* Fixed DNS eventtype to use source rather than sourcetype + +## 10.2.0 + +* February 9, 2020 +* Tested with Sysmon version 10 +* +* Added Event Type [ms-sysmon-dns], to capture EventCode=22 Sysmon events as DNS events. +* Added network/resolution/dns tags for event type [ms-sysmon-dns]. +* Added FIELDALIAS for query/reply_code_id for CIM compatibility. +* Added transform entry [extract_dns_record_data] to extract record info for DNS responses like CNAME. Added transform entry [extract_dns_ip_data] to properly extract IP addresses from DNS responses. + +## 10.1.0 + +* July 30, 2019 +* Tested with Sysmon version 10 +* +* Updates to work with the new Splunk_TA_windows v5 and onwards - +* All searches,reports and dashboards using sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" need to use source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" instead, due to the upgrade to Splunk_TA_windows v5 + +## 10.0.0 + +* June 13, 2019 +* Tested with Sysmon version 10 +* +* Added support for Sysmon v10 having new DNS Query event type. +* Provided inputs.conf examples enabling blacklist of multiple DNS Query events based on complex rule groups + +## 8.1.0 + +* December 11, 2018 +* Tested with Sysmon version 8.0 +* +* Updates to work with the new Splunk Enpoint Data Model - http://docs.splunk.com/Documentation/CIM/4.12.0/User/Endpoint +* Thanks to Bhavin Patel for contributions (@patel-bhavin) + +## 8.0.0 + +* July 11, 2018 +* Tested with Sysmon version 8.0 +* + +## 6.0.8 + +* June 8, 2018 +* Tested with Sysmon version 6.20 +* + +## 6.0.7 + +* Nov 24, 2017 +* Tested with Sysmon version 6.20 +* + +## 6.0.6 + +* Nov 22, 2017 +* Added FIELDALIAS for EventID/EventCode for compatibility with Sigma rules. +* + +## 6.0.5 + +* Sep 12, 2017 +* Support for new features of Sysmon v6.10 + +## 6.0.4 + +* Sep 9, 2017 +* Prep for Splunk certification. + +## 6.0.3 + +* Typo corrected. +* Special thanks to David Dorsey ( for this contribution. + +## 6.0.2 + +* Field extractions added including but not limited to cmdline, parent_process, +* and parent_process_id. +* Special thanks to David Dorsey ( for this contribution. + +## 6.0.1 + +* Field extractions for MD5, SHA1, SHA256, IMPHASH +* Special thanks to David Staulcup ( for ongoing assistance and contributions + +## 6.0.0 + +* Updates to support sysmon V6 +* Special thanks to David Staulcup ( for ongoing assistance and contributions + +## 5.0.0 + +* Updates to support sysmon V5 +* Note the sample configuration included below was modified to exclued the +* ImageLoad section which was found to be causing BSOD on some Windows 7 test systems. +* Special thanks to David Staulcup ( for ongoing assistance and contributions + +## 4.0.0 + +* Minor updates to support Sysmon V4 and optimize the hash field extraction. + +## 3.2.3 + +* Minor updates to add workflow actions via pull request and subsequent fine tuning. + +## 3.2.2 + +* Minor updates to extract various hash values into individual fields for convenience: + +## 3.2.1 + +* Minor updates to align with sysmon version 3.21. For details see: + +## 3.1.1 + +* Major modification of the version to better align with SplunkBase. +* Fixed typos in eventtypes.conf and props.conf + +## 0.3.1 + +* Lookup table added to support Sysmon 3.1 +* Additional CIM compliance added +* Example config added +* Revved to version 0.3.1 to match current Sysmon version + +## Using this TA + +Configuration: Install TA via GUI on all search heads, install via your preferred method (manual or Deployment Server) on forwarders running on Windows that have Sysmon 3.1 or greater installed. + +Ensure that you have at least version 6.2.0 universal forwarders to take advantage of Windows XML event log format. + +Sysmon ProcessCreate events may pick up passwords in CommandLine and ParentCommandLine fields. Depending on organizational policy you may be required to mask passwords either at search time or prior to indexing. SEDCMD entries can be added to props.conf files on search heads or indexers to mask data in known positions of passwords. Note this contribution has not been widely tested and may require substantial additional configuration and tuning effort. Use at your own risk. + +```bash +SEDCMD-pwd_rule1 = s/ -pw ([^\s\<])+/ -pw ***MASK***/g +``` + +The Sysmon v10 configuration XML spec does not allow for mutiple log-write exclusions based on rule groups. It is possible to achieve complex log forwarding exclusions for high volume DNS Query Events with inputs.conf blacklist specs. See comments in inputs.conf for implementation examples. + +For additional info on Sysmon see: + +## Support + +This is a community supported TA. As such, post to answers.splunk.com and reference it. + +## Recommended Configuration + +We strongly recommend that you use the popular Sysmon configuration shared by SwiftOnSecurity as your starting point: + + + +## Previously Recommended Configuration + +*3/16/2017* - The following configuration guidance was included historically +but should now be considered deprecated. We suggest instead that you use the +SwiftOnSecurity configuration as a starting point, and tune it to meet your needs. +You may choose to use elements of the legacy configuration below, particularly if +you are interested in excluding common Splunk image/file names from creating Sysmon +events. + +*NOTE:* If you choose to exclude certain events based on file name, please be aware +that this could potentially be abused by an attacker to hide malicious activity by +choosing an excluded name for their malware. If you are not willing to accept this +risk, do not use the configuration below. + +Sysmon is capable of delivering a large amount of events into your +Splunk instance. The following configuration, loaded into each +system running Sysmon 3.1 or greater, will reduce the amount of data considerably. +Special thanks go to Jeff Walzer from the University of Pittsburgh for +originally helping to test this (walzer@pitt.edu). + +Load this via sysmon -c (filename) from an admin-level command prompt. +(after you have placed it in a text file). You may get some +unusual errors - these are benign and can be ignored. Check the +filtering via a "sysmon -c" with no argument. + +For additional Sysmon filtering, remove the entire ImageLoad section. + +```xml + + * + + + + + microsoft + windows + + + + splunk + streamfwd + splunkd + splunkD + splunk + splunk-optimize + splunk-MonitorNoHandle + splunk-admon + splunk-netmon + splunk-regmon + splunk-winprintmon + btool + PYTHON + + + splunk + streamfwd + splunkd + splunkD + splunk + splunk-optimize + splunk-MonitorNoHandle + splunk-admon + splunk-netmon + splunk-regmon + splunk-winprintmon + btool + PYTHON + + + splunk + streamfwd + splunkd + splunkD + splunk + splunk-optimize + splunk-MonitorNoHandle + splunk-admon + splunk-netmon + splunk-regmon + splunk-winprintmon + btool + PYTHON + + + +``` diff --git a/deployment-apps/TA-microsoft-sysmon/default/app.conf b/deployment-apps/TA-microsoft-sysmon/default/app.conf new file mode 100644 index 00000000..aeddbf5f --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/app.conf @@ -0,0 +1,15 @@ +[launcher] +description = Provides data inputs for handling Microsoft Sysmon +version = 10.6.2 + +[package] +id = TA-microsoft-sysmon +check_for_updates = true + +[install] +is_configured = false +state = enabled + +[ui] +is_visible = false +label = Microsoft Sysmon Add-on diff --git a/deployment-apps/TA-microsoft-sysmon/default/eventtypes.conf b/deployment-apps/TA-microsoft-sysmon/default/eventtypes.conf new file mode 100644 index 00000000..d4e2702d --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/eventtypes.conf @@ -0,0 +1,17 @@ +[ms-sysmon-network] +search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="3" + +[ms-sysmon-process] +search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="1" OR EventCode="5" OR EventCode="6" OR EventCode="8" OR EventCode="9" OR EventCode="10" OR EventCode="15" OR EventCode="17" OR EventCode="18") + +[ms-sysmon-filemod] +search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="11" OR EventCode="2") + +[ms-sysmon-regmod] +search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="12" OR EventCode="13" OR EventCode="14") + +[ms-sysmon-wmimod] +search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="19" OR EventCode="20" OR EventCode="21") + +[ms-sysmon-dns] +search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="22" diff --git a/deployment-apps/TA-microsoft-sysmon/default/inputs.conf b/deployment-apps/TA-microsoft-sysmon/default/inputs.conf new file mode 100644 index 00000000..3af8ac05 --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/inputs.conf @@ -0,0 +1,7 @@ +[WinEventLog://Microsoft-Windows-Sysmon/Operational] +disabled = true +renderXml = 1 +source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +# Prevent forwarding of multiple DNSQuery logs based on complex rule groups +# blacklist1 = EventCode="^22$" Message="(?i)QueryName:\s+(.*\.arpa\.)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\sysmon\.exe)$" +# blacklist2 = EventCode="^22$" Message="(?i)QueryName:\s+(HelloWorld.local)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\system32\\ping\.exe)$” diff --git a/deployment-apps/TA-microsoft-sysmon/default/props.conf b/deployment-apps/TA-microsoft-sysmon/default/props.conf new file mode 100644 index 00000000..18df59de --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/props.conf @@ -0,0 +1,72 @@ +##Below fields extractions have been moved from [XmlWinEventLog:Microsoft-Windows-Sysmon/Operational] +[source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational] +#SEDCMD-pwd_rule1 = s/ -pw ([^\s\<])+/ -pw ***MASK***/g +REPORT-sysmon = sysmon-eventid,sysmon-version,sysmon-level,sysmon-task,sysmon-opcode,sysmon-keywords,sysmon-created,sysmon-record,sysmon-correlation,sysmon-channel,sysmon-computer,sysmon-sid,sysmon-data,sysmon-md5,sysmon-sha1,sysmon-sha256,sysmon-imphash,sysmon-hashes,sysmon-filename,sysmon-registry,sysmon-dns-record-data,sysmon-dns-ip-data + +FIELDALIAS-src_ip = SourceIp AS src_ip +FIELDALIAS-src_host = SourceHostname AS src_host +EVAL-src = if(isnotnull(SourceHostname),SourceHostname,SourceIp) +FIELDALIAS-src_port = SourcePort AS src_port +FIELDALIAS-app = Image AS app +FIELDALIAS-dest_ip = DestinationIp AS dest_ip +FIELDALIAS-dest_host = DestinationHostname AS dest_host +EVAL-dest = case(EventCode=="3" AND isnotnull(DestinationHostname),DestinationHostname,EventCode=="3",DestinationIp,EventCode=="1" OR EventCode == "11" OR EventCode == "12" OR EventCode == "13" OR EventCode == "14", Computer) +FIELDALIAS-dest_port = DestinationPort AS dest_port +EVAL-direction = if(Initiated=="true","outbound","inbound") +FIELDALIAS-dvc = Computer AS dvc +FIELDALIAS-transport = Protocol AS transport +EVAL-protocol = if(Initiated=="true",DestinationPortName,SourcePortName) +FIELDALIAS-session_id = ProcessGuid AS session_id +EVAL-vendor_product = "Microsoft Sysmon" +FIELDALIAS-cmdline = CommandLine AS cmdline + +#Common fieldnames for Registry, Process, FileSystem Node in Endpoint Datamodel +EVAL-action = case(EventCode=="1","allowed",EventCode=="12" AND EventType=="CreateKey","created",EventCode=="12" AND (EventType=="DeleteKey" OR EventType=="DeleteValue") ,"deleted",EventCode=="13" AND EventType=="SetValue","modified",EventCode=="11" AND EventDescription=="File Created","created") + +#Ports Node +EVAL-creation_time = case(EventCode=="3",UtcTime) +EVAL-state = case(EventCode=="3", "listening") + +#Processes Node +EVAL-parent_process_exec = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18", replace(ParentImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"") +FIELDALIAS-parent_process_id = ParentProcessId AS parent_process_id +FIELDALIAS-parent_process_guid = ParentProcessGuid AS parent_process_guid +FIELDALIAS-parent_process_path = ParentImage AS parent_process_path +FIELDALIAS-process_current_directory = CurrentDirectory AS process_current_directory +EVAL-process_exec = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18" OR EventCode="22", replace(Image,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),EventCode=="6","System",EventCode=="8" OR EventCode=="10",replace(SourceImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"") +FIELDALIAS-process_hash = Hashes AS process_hash +FIELDALIAS-process_guid = ProcessGuid AS process_guid +FIELDALIAS-process_id = ProcessId AS process_id +FIELDALIAS-process_integrity_level = IntegrityLevel AS process_integrity_level +FIELDALIAS-process_path = Image AS process_path +FIELDALIAS-user_id = UserID AS user_id +REPORT-user_for_sysmon = User_as_user +FIELDALIAS-parent_process = ParentCommandLine AS parent_process +EVAL-parent_process_name = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18", replace(ParentImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"") +FIELDALIAS-process = CommandLine AS process +EVAL-process_name = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18" OR EventCode="22", replace(Image,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),EventCode=="6","System",EventCode=="8" OR EventCode=="10",replace(SourceImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"") + +#Filesystem Node +FIELDALIAS-file_path = TargetFilename AS file_path +FIELDALIAS-file_create_time = CreationUtcTime AS file_create_time + +#Fields for ChangeAnalysis DM (old field names) +EVAL-object_category = case(EventCode=="11" OR EventCode=="2", "file", EventCode=="12" OR EventCode=="13" OR EventCode="14", "registry", EventCode=="19" OR EventCode=="20" OR EventCode="21", "wmi") +EVAL-object_path = case(EventCode=="12" OR EventCode=="13", TargetObject, EventCode=="14", NewName) +LOOKUP-eventcode = eventcode EventCode OUTPUTNEW EventDescription EventDescription AS signature +FIELDALIAS-signature_id = EventCode AS signature_id +FIELDALIAS-eventid = EventCode AS EventID + +#Registry Node +EVAL-registry_path = case(EventCode=="12" OR EventCode=="13" OR EventCode=="14", TargetObject) +EVAL-registry_value_name = case(EventCode=="13", Details) +EVAL-registry_key_name = case(EventCode=="12" OR EventCode=="13" OR EventCode=="14",replace(TargetObject,".+\\\\","")) + +#DNS Node +FIELDALIAS-query = QueryName AS query +FIELDALIAS-replycode = QueryStatus AS reply_code_id + +## To provide backward compatibility for WinEventLog and XmlWinEventLog data +## These will be deprecated in future +[XmlWinEventLog:Microsoft-Windows-Sysmon/Operational] +rename = xmlwineventlog diff --git a/deployment-apps/TA-microsoft-sysmon/default/tags.conf b/deployment-apps/TA-microsoft-sysmon/default/tags.conf new file mode 100644 index 00000000..e48884fb --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/tags.conf @@ -0,0 +1,28 @@ +[eventtype=ms-sysmon-network] +network = enabled +communicate = enabled +port = enabled +listening = enabled + +[eventtype=ms-sysmon-process] +process = enabled +report = enabled + +[eventtype=ms-sysmon-filemod] +change = enabled +endpoint = enabled +filesystem = enabled + +[eventtype=ms-sysmon-regmod] +change = enabled +endpoint = enabled +registry = enabled + +[eventtype=ms-sysmon-wmimod] +change = enabled +endpoint = enabled + +[eventtype=ms-sysmon-dns] +network = enabled +resolution = enabled +dns = enabled diff --git a/deployment-apps/TA-microsoft-sysmon/default/transforms.conf b/deployment-apps/TA-microsoft-sysmon/default/transforms.conf new file mode 100644 index 00000000..146790e4 --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/transforms.conf @@ -0,0 +1,103 @@ +[sysmon-eventid] +REGEX = (\d+) +FORMAT = EventCode::$1 + +[sysmon-version] +REGEX = (\d+) +FORMAT = Version::$1 + +[sysmon-level] +REGEX = (\d+) +FORMAT = Level::$1 + +[sysmon-task] +REGEX = (\d+) +FORMAT = Task::$1 + +[sysmon-opcode] +REGEX = (\d+) +FORMAT = Opcode::$1 + +[sysmon-keywords] +REGEX = (0x[0-9a-fA-F]+) +FORMAT = Keywords::$1 + +[sysmon-created] +REGEX = +FORMAT = TimeCreated::$1 + +[sysmon-record] +REGEX = (\d+) +FORMAT = RecordID::$1 + +[sysmon-correlation] +REGEX = (.*?) +FORMAT = Correlation::$1 + +[sysmon-channel] +REGEX = (.*?) +FORMAT = EventChannel::$1 + +[sysmon-computer] +REGEX = (.*?) +FORMAT = Computer::$1 + +[sysmon-sid] +REGEX = +FORMAT = SecurityID::$1 + +[sysmon-data] +REGEX = (.*?) +FORMAT = $1::$2 + +[sysmon-md5] +REGEX = MD5\=([a-fA-F0-9]{32}?) +FORMAT = MD5::$1 + +[sysmon-sha1] +REGEX = SHA1\=([a-fA-F0-9]{40}?) +FORMAT = SHA1::$1 + +[sysmon-sha256] +REGEX = SHA256\=([a-fA-F0-9]{64}?) +FORMAT = SHA256::$1 + +[sysmon-imphash] +REGEX = IMPHASH\=([a-fA-F0-9]{32}?) +FORMAT = IMPHASH::$1 + +[sysmon-hashes] +SOURCE_KEY = Hashes +REGEX = (?[A-Fa-f0-9]{32,}) +MV_ADD = true +REPEAT_MATCH=true + +[sysmon-filename] +SOURCE_KEY = TargetFilename +REGEX = (?[^\\\\]+$) + +[sysmon-registry] +SOURCE_KEY = TargetObject +REGEX = (?[^\\\\]+$) + +[eventcode] +default_match = Unknown +filename = eventcode.csv +min_matches = 1 + +[User_as_user] +SOURCE_KEY = User +REGEX = (?:[^\\]+\\)?(.+) +FORMAT = user::"$1" + +[sysmon-dns-record-data] +SOURCE_KEY = QueryResults +REGEX = type:\s+(?\d+)((?[^;]+)+) +REPEAT_MATCH = true +MV_ADD = true + +[sysmon-dns-ip-data] +SOURCE_KEY = QueryResults +REGEX = (?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})+) +REPEAT_MATCH = true +MV_ADD = true diff --git a/deployment-apps/TA-microsoft-sysmon/default/workflow_actions.conf b/deployment-apps/TA-microsoft-sysmon/default/workflow_actions.conf new file mode 100644 index 00000000..51c73b13 --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/default/workflow_actions.conf @@ -0,0 +1,47 @@ +[get_parent_process_create] +display_location = both +eventtypes = ms-sysmon-* +fields = ParentProcessGuid, host +label = Get parent process creation event +search.app = search +search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$ParentProcessGuid$ $ParentProcessGuid$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose +search.target = blank +type = search +search.earliest = -35d@d +search.latest = now + +[get_process_create] +display_location = both +eventtypes = ms-sysmon-* +fields = ProcessGuid, host +label = Get process creation event +search.app = search +search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$ProcessGuid$ $ProcessGuid$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose +search.target = blank +type = search +search.earliest = -35d@d +search.latest = now + +[get_process_create_sysmon_create_remote_thread] +display_location = both +eventtypes = ms-sysmon-* +fields = SourceProcessGuid, host +label = Get process creation event +search.app = search +search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$SourceProcessGuid$ $SourceProcessGuid$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose +search.target = blank +type = search +search.earliest = -35d@d +search.latest = now + +[get_process_create_sysmon_process_access] +display_location = both +eventtypes = ms-sysmon-* +fields = SourceProcessGUID, host +label = Get process creation event +search.app = search +search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$SourceProcessGUID$ $SourceProcessGUID$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose +search.target = blank +type = search +search.earliest = -35d@d +search.latest = now diff --git a/deployment-apps/TA-microsoft-sysmon/local/inputs.conf b/deployment-apps/TA-microsoft-sysmon/local/inputs.conf new file mode 100644 index 00000000..6f96aa90 --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/local/inputs.conf @@ -0,0 +1,8 @@ +[WinEventLog://Microsoft-Windows-Sysmon/Operational] +disabled = true +renderXml = 1 +source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +index = sysmon +# Prevent forwarding of multiple DNSQuery logs based on complex rule groups +# blacklist1 = EventCode="^22$" Message="(?i)QueryName:\s+(.*\.arpa\.)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\sysmon\.exe)$" +# blacklist2 = EventCode="^22$" Message="(?i)QueryName:\s+(HelloWorld.local)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\system32\\ping\.exe)$” \ No newline at end of file diff --git a/deployment-apps/TA-microsoft-sysmon/lookups/eventcode.csv b/deployment-apps/TA-microsoft-sysmon/lookups/eventcode.csv new file mode 100644 index 00000000..08e2e80f --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/lookups/eventcode.csv @@ -0,0 +1,24 @@ +EventCode,EventDescription +1,"Process Create" +2,"File Create Time" +3,"Network Connect" +4,"Sysmon Start" +5,"Process Terminate" +6,"Driver Load" +7,"Image Load" +8,"Create Remote Thread" +9,"Raw Access Read" +10,"Process Access" +11,"File Created" +12,"Registry object added or deleted" +13,"Registry value set" +14,"Registry object renamed" +15,"File stream created" +16,"Sysmon Configuration Changed" +17,"Pipe Created" +18,"Pipe Connected" +19,"WmiEventFilter activity detected" +20,"WmiEventConsumer activity detected" +21,"WmiEventConsumerToFilter activity detected" +22,"DNS Query" +255,"Error" diff --git a/deployment-apps/TA-microsoft-sysmon/metadata/default.meta b/deployment-apps/TA-microsoft-sysmon/metadata/default.meta new file mode 100644 index 00000000..fb03ab48 --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/metadata/default.meta @@ -0,0 +1,19 @@ +[] +access = read : [ * ], write : [ admin ] +export = system +owner = admin + +[lookups/eventcode.csv] +access = read : [ * ], write : [ admin ] +export = system +owner = admin + +[transforms/eventcode] +access = read : [ * ], write : [ admin ] +export = system +owner = admin + +[props/XmlWinEventLog%3AMicrosoft-Windows-Sysmon%2FOperational/LOOKUP-eventcode] +access = read : [ * ], write : [ admin ] +export = system +owner = admin diff --git a/deployment-apps/TA-microsoft-sysmon/splunkbase.manifest b/deployment-apps/TA-microsoft-sysmon/splunkbase.manifest new file mode 100644 index 00000000..72354836 --- /dev/null +++ b/deployment-apps/TA-microsoft-sysmon/splunkbase.manifest @@ -0,0 +1,115 @@ +{ + "version": "1.0", + "date": "2022-11-12T07:37:52.85389958Z", + "hashAlgorithm": "SHA-256", + "app": { + "id": 1914, + "version": "10.6.2", + "files": [ + { + "path": "LICENSE", + "hash": "fafadb38a456ef92b87c789d43e1f5196d20af522d20f278a5a5a94eaff02634" + }, + { + "path": "README.md", + "hash": "6afc4cb54ad03383d8f8302ed5f101a529abfecb2a1661d6d008b886e5ad33bb" + }, + { + "path": "metadata/default.meta", + "hash": "742349369b044cd452810ccb992a8204829c545493f91a7362f485480825c6e9" + }, + { + "path": "static/appIcon.png", + "hash": "eb32e7c1128dbf893556484ebe4e60ffd346c053ededb56183d4946695f09af1" + }, + { + "path": "static/appIcon_2x.png", + "hash": "36a2ba98b7c8f93b348fa5c05d959f3509e46e075b53709866e248b662a1f8d0" + }, + { + "path": "default/eventtypes.conf", + "hash": "3793dd0743f05a577ba2a634aa047024250975f592b4c97c03a704cecf919d8c" + }, + { + "path": "default/app.conf", + "hash": "de4b8d29080acbdd2a852149e345be97be94158655978ef59f11081746063c6e" + }, + { + "path": "default/tags.conf", + "hash": "fb44caea391dd55023f1430c3487188f2f0093aef2b8f698b55634513d15becb" + }, + { + "path": "default/props.conf", + "hash": "3372b9ea6a72872532e76c821bca51df6ef8387d071b17df8cea2d6d85c8a19b" + }, + { + "path": "default/inputs.conf", + "hash": "c5916bf171b84fe9e8782f3d5aaac3dcefebe4c4080a387d5691616f9294e223" + }, + { + "path": "default/transforms.conf", + "hash": "841ae8258aa880de9ec7ad4fbcbe2c1bf3033e983c4a898589d78798beb0cb51" + }, + { + "path": "default/workflow_actions.conf", + "hash": "a0d4912df84d2fc104ca546e197879eb6de371a83fe2d1a14c8b4c0da320daf8" + }, + { + "path": "lookups/eventcode.csv", + "hash": "98e01540455f697a3e43de4e5baa21f28d77a11923a09f3fce4590f97864dd07" + } + ] + }, + "products": [ + { + "platform": "splunk", + "product": "enterprise", + "versions": [ + "7.0", + "7.1", + "7.2", + "7.3", + "8.0", + "8.1", + "8.2", + "9.0" + ], + "architectures": [ + "x86_64" + ], + "operatingSystems": [ + "windows", + "linux", + "macos", + "freebsd", + "solaris", + "aix" + ] + }, + { + "platform": "splunk", + "product": "cloud", + "versions": [ + "7.0", + "7.1", + "7.2", + "7.3", + "8.0", + "8.1", + "8.2", + "9.0" + ], + "architectures": [ + "x86_64" + ], + "operatingSystems": [ + "windows", + "linux", + "macos", + "freebsd", + "solaris", + "aix" + ] + } + ] +} \ No newline at end of file diff --git a/deployment-apps/TA-microsoft-sysmon/static/appIcon.png b/deployment-apps/TA-microsoft-sysmon/static/appIcon.png new file mode 100644 index 0000000000000000000000000000000000000000..82990e58cd716697e66c80478e5ee8568feffe3a GIT binary patch literal 1736 zcmV;(1~>VMP)(_`g8%^e{{R4h=>PzAFaQARU;qF*m;eA5Z<1fd zMgRZ?PDw;TRCwC7S6y!%R~21*pEEPp*LD)CPEv<9q-hhBrfLy|LW1~s;6qfr@qz?` zKf@2;2kdb0ph@+?K$HeIG>cCZ+BIdwJ4Ib}15A%iHm9jre|omnx=kVy)X2!o`9 zg%Ln+79yEp6sTz+2hPS0DuFO&O~0u#``m4y3&Q#fW=6q){1lv2*FXvqN0lnK%Pce6^$5~Y~N@(cpO z4K@R>m(IL&;hooxuAW}~+qFO5eQ>QBM&wCV6{C8yZrY+KfJ~G`31q1GjF)K|%-vys zZcoptNI8{NIlH~P`{JNFvvlUv(uw7@t5wu!?L8z_zXLy zY*2dlR~IMsq)%x-q<}PNM#e_FJC7~La9GXw@aW-_XJ2`9@z}}TEk54ZVFO2|Aom6g zv|0OGwWo`qK~<%n{QAOpJnD^$=n)qH#t}m@8$I4yU0J)f_VI0*&&?k%((IAhrL(Vo zb!qYB_LIruhg+iMLD8Znnk?UoR(yIG465|wUw*T5*1@%@vkX2QtAN}H;@px=7sBiVX zi?&T4!GNNY=ay>HWOH)w*7~LU8+U@cgW1{H;_%T!$Irg<`oar`Z{7W%joM^;z1t59 zP^_vdOQJYUo3=+tsd(7Z6!XqGDw~I=9bvP`&AkWP>vwKkuKx1F3qSkHt8Y|k?u8>K zDxV)QXtAH}1~-UZQ}2pTCL?&blWMKoH8L}oina~I2&i-6h>6t`$E0rSYGdKV;+Nh& zfAQ4PX%Lpsv>1(SCxX>B6fgml=vGh;rILp-85Fx^z^9qXAh1D7Nt#3(lDn#AX9msT zmye&i@PmtQo&WlLJ_h)RJO5g{{*UFqw)RP@#|k&=D8{a46hWgROQga`f>UP%+#s`} z9`9DAjBV^9>cPv4Z+-h~KRtKm{4f<6*wWU@M<4$4#+93^S2xG^eRjgK1!o1JD~$+m zMHeA4OCg02E{U9$%tTJ=&Ea5(2{@`=d+Ge!=f3m$sS69`LIZ5!$@2R3_pknW?W3DJ z^@hr^hD~?`+tg2nm@dzt0J#_$0!dFILyGANqJWeeP|eQlyWjiy#W%h`?+Xq-YCm3C z{qXYgrMvf*H@EMnL9Lkv-U<$uVo7k?sT4p0GAaOMnWT^a#8iS95a#Zw9q)_^EuK5| ztvO%Vj`6?OFI~Cz`@8qAZ#Llt(p z0Rs#&7}_X`q^4c}!+XD7U0bW`232nI>=-jc?Fu30 zP?&om1g1?5ct$|Eu_GuC%ZyYuGwzbxlb*D7Mgw$I@W3ztAORgh1O%m^lV)CKpzQ?+ z*fmG5EhJd%t(~blky_YOp`mAFR9_{71tfse|0W4&vp}Iy7oGwTkf5$|d_H*(sT)^- ztee9yp=)Y{)TPkwZE898jnprqOcRU{fY!`~kW8?Sjcp%~qMOd>DknUzGlTVgZPvof zECC?f+%zFFAah!;<-BhI^XJsS=1F|n9s*XpH2`;6q8ww eMvIHb|2qI51^#cvb|ygp0000(_`g8%^e{{R4h=>PzAFaQARU;qF*m;eA5Z<1fd zMgRa3EJ;K`RCwCdTibFY*L7WMpVJM1;B`0`N@Gd3>{R9Q9=rSlj`Iz6@-z92{7pU~ zl_#fEvZV2FcmoL%1kl}QuRNUYMuX%?a>bq+V=yx$h|5{MZ)>l;$^ZPX|B%!)jUb7BfaSo+5K>ATS9F)845TwIB?0<~ad8kh>VUya0AdD1qW9Iuk9@qy_{1am z9!Uda<|IgF!?w@)*gcT|$jxb`96?4hTTEmhg&4Y@K4PnN*L`?Gksy_0%w3*uIbm$) znU6Ym40CvwNQ~wNL_in-Gh+@!BeSVL=9CD*+pNf({{RFzvMaJnoFt?+X{hyJeZ;^3 zwN525W5{2Thy$}aV1V~zr4P`L*%b$;%@EoHM|XKPY9CSTEGB%+b!_Xj%K03ET!Jfh zSoOd}TTnmpl;2vfx0nErU~3ymXd{aK1<_yO5PJ0W|Lfh_tS_M_jsO)qtkM>G=m%m< z4=>ph&k!Hbp8=4k-n|FQ9~WU6g>9dyrGc?Sst3&Q`<;;QJrCPQB;-FJySne%_`}xQ zu=jiN5jOomnbtNX&NoI3Oy<5}UwXee1d2fbB|w%V)>FPT9j74(ff5}csOV17Ib1_`1B*T#9;^7a%m(VV3~C>a_mK`EuRQVn^a zF&blm5QX4Uf{StU=HKA-P7Q-Iqr%%2?jr-OjFNx3}|kv$jHU zM{#6@QEDUsDSIZ2q?uXB{h>QNi3zUO1fnAla!{hWFnkiy{NVNe&a;dC7YCEw+3neUbtYDouNtqFYIl)t zXoLox)x-bC`oru?w;fXK$Bc@(b_5~ z*?XlIJ_xz4ga}ah?eBk`<+r}k+`a%$AvG6826|)~F%^??Z&Z#)#mK-IqS0a~#^uh@ z^k{GIU}rR)lm}%o9*?GEREntqoaRQ6qC0c?%V%{^WNO(-n=0Q^njg{>GYcV@S@_p~ z`?aJdCC}ygL4|(&j-A#c4_;HXd17DzcY}mflp#b0lmLKGgmO~u9_}6Q9~|u+J_~Uq zkE{EtUZrYPdm>>#AOl1v0TazLPlrfxQy!kO*uWzNm{}2nnT6lBz-sr@;nH@RdQ3b5 zFj6X&f}9ZH&APf&^UGzmY*Jkm9d2wG7pwKM zuGW=g7D9;8f{Ah^!3kOGrSGrJgRE#~MNwpn{YvttsohiOiTwheS3d>zgjGoi*?g1t97C^E?F=O<52FEJBQQb!@Xyd(e6&U7sF^= zOrw>-N{IrKk}H7@f`o~dIpg**GGQ4WI9seJq8Y=#{Qg(&o-H;^_U~gJfTSQV03)4D zWFxD|hHPL?gQ&V`7K_F0-C{PMFV|J=wUvd+5D^FjpbX`t+&S1gIy`uGcz9ftCB*yH z{c^ot*DEoFfDkRv_;l`gbi&SJdD;?w^SfVWU@0Z`R9lg%iEj#>$}y>?dodPEEd&W&ALjBnH3hwSnP~;4)>lP>>o|W)5&Nzgjkj% zXL6;annn}lx!r$wh^=NokmT}yj1+$JyI;!H)Xjq!>#oOR5jocv2P?1!8_+=_7%ad7 z5L$@Q5F|Ehzq?(W-7GHV_gCxnvT5!^VOH7*<9x|Oh~r|izk9fUuzzr{CriuqVzIi* z%_K!W9qW3m#+k8*1=;pv-bU1;*Xywp2tWf{ib=?NcpwTx1nH2NL@+o^j%D)2Dy>sf z&#Te+?r1)Ldp>=3dHs|9o#!w1U+<5f9ZU|(qL_|$r=#8dy@R9bXyuEmoAaxi3mFtL z2mX<&Rj%a@SVX5#J>Xt_^ZU39B3-ryD}n9>y#QmjQp%ktVb*{Rm}He<9VSh1_r&Yl zWd<+XdA zYBSr^XZcfu2||Q5QsZdc>7Eao8o#fUV!`z!9vsA% z^-<-nvL;36|VMPawhA4%m2~`CqC^}*dHW;XgnX*d)Xbjn4E=rJvC<%%wo6A#`YJvul0{lI| z*fP3?j*y8f;LutEogvZ)cydqhq?F(SqtQm%9gmKV_D=Tqk3W6+#fziYCog}xzxQHi zG69ev_hwNqu2)yH`Q@s*PhJa+Sb+_!=?KGGqZyeG{WGasZg)f)E+q=jVAm1C$FA=`o+nYFP@*gJbJxT98N}uMKQ`BvToZkn1wVH~H&N1weq{^Il3zc@ZRe!hRa6U*K4bc9Jp)nIkk++JLt&aN-s zoPTq9^X}~CPs{aum2MC!Sp}pv1jP12Q`@B|PxCyJtAQHOY98%fVy6f>+<~m;4ZYM_ z*-TljO9Ut)$!k}#pkh)^<7j7Za&ox)$>%Ts{?ivf{mG|a9!z&fod8^+xnEzc>c!RF z`Ssn^>G`*_*}Jo=H@C~{+x5&*A=ZTfCWpI%DL2<>^{lND>l-%|0YW(_JPxD+_2zxb zV(kC(l#(ZzVhGWq38|{rO9d6<@&3!BPoEu}yngX_$A_;^4!+nQA56!){j_R@`mVk{ zoqczC`R?u6H}kuz+5FwQx?9#ajVc>8q!6-t=0eIgB6=O|!5Fz+ZOGG>9*ERR1D+dl zZeH+Mw<46ILaxSDK{N|gNR?aK-5)=Dw)g7!(aGnpzI<_b^6B%R9_+rDV3J?lczs*l z-#7Oc%d^@1{LSgt=NE4;F1}l?@7B#+s1X~BV05&ElL9j>f26(nHj!c{o@TMxJI!Mo zLbvUqCzd=mkBBB32&JTIsr~W(Coez$`Dg#|`uS&{9DFt@c6Ue90@?ep#^P>y_jdO7 zZ2s=e)i*cu+2!@=VsX7%-@qD<8ZaTaOszI50w$OgI_HiR&Sc|GvxFkNvicXl=e*2(I z_rhc7CNnvSB(NyU(eBRPI8JK$eYIRv)%oq4tDEn>d-p#VS6`pazFJi`%X*zyz={xP zMV9oDm^|m+c5%jl07WQJp*?_MAXh&o58kD_E+uw#Y}mT_c9)~A$)f~V&a0JlBYZ>#?XCqwSpf*M%Uq}!W$Ema8~#{kVa zZsn6 z(AsIZHWufgl;y9j*RvcXS-UsYN@`*e8DkzdCn>W}y4uMsEFlQyecReiE&+j_hdF~R z%yz!B)l5C!s$g!$yycPxgh-3D1kr&c1leW|_TcSg9c}3;H-W-wU|_KWNM<12^WGK> zfpTHxz9QU_1nYdj2@SLdbpZw-D>$+H^qy(j_RuK1UN%0H-~wc{KnrnGv%CDk?h!l= zvrRJbu9j1ZV3GNEhVAIeK1eiFO}PN4b)nxgya%N+r;v72px+sNijEH{5d{uNAOS`o zNoha~`xdi*C=L9ub0KbkG4B}nk=&)!&GH8NZ3KU`e)2>++(iKgq>0F%s3)h&+MYls zAZ;;^A<59z>$!c0HngovI()crGx%}8m%@i@ls`1iYn#B9sXlHydVBUC-!qT)iAhMx z>jxXD#JNFb{kmCB`j2M7Ti5(OKh=+tJ)d}l?I&(@xPHwi45uhX6%dmm=yj|1VY7p*-j(m2uln-Y0A7nR{ zgFzi1O#O$y945(yz8daXFq&_lly7MNt4M ziqhpV+MfeVA28j24>0S1p=rD*%c3ZXqWHf70EoMvynVWIEC2ui07*qoM6N<$g867I AP5=M^ literal 0 HcmV?d00001