Git Product home page Git Product logo

Comments (4)

harsha2010 avatar harsha2010 commented on August 20, 2024

To generate a dataset to test this, use:

import numpy as np
import pandas as pd

processes = ["c:\\\\program files\\\\splunkforwarderforsplunkinc\\\\bin",
                  "C:\\\\Windows\\\\system32\\\\conhost.exe 0xffffffff",
                  "C:\\\\Program Files\\\\SplunkForwarderForSplunkInc\\\\bin\\\\splunk-powershell.exe",
                  "C:\\\\Program Files\\\\SplunkForwarderForSplunkInc\\\\bin\\\\splunk-admon.exe",
                  "C:\\\\Program Files\\\\SplunkForwarderForSplunkInc\\\\bin\\\\splunk-winhostinfo.exe"]

anomalous_process = "relog.exe C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\Logging\\\\Diagnostics\\\\PerformanceLogsToBeProcessed\\\\ExchangeDiagnosticsPerformanceLog_09242014.blg -f csv -o C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\Logging\\\\Diagnostics\\\\PerformanceLogsToBeProcessed\\\\ExchangeDiagnosticsPerformanceLog_09242014.csv tmp -y"

all = list(np.random.choice(processes, 20))
all.append(anomalous_process)
data = ["{" + "\"process\": \"{}\", \"dest_user_id\": \"a\", \"dest_ip_id\": \"192.168.0.1\", \"_time\": {}, \"process_name\": \"b\"".format(v, i) + "}"
 for (i, v) in zip(range(len(all)), all)]

with open("unusual_commandline.json", "w") as outfile:
    outfile.write("\n".join(data))

from security_content.

harsha2010 avatar harsha2010 commented on August 20, 2024

unusual_commandline.txt

from security_content.

harsha2010 avatar harsha2010 commented on August 20, 2024

To test this in smle, we don;t need SSA data sources. We can simply use the first two lines to mimic them.

| from read_text("s3://smle-labs-test-customer-bucket/ssa/unusual_commandline.json")
| eval input_event=from_json_object(value)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval cmd_line=ucast(map_get(input_event, "process"), "string", null),
dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null)
| where cmd_line!=null and dest_user_id!=null
| eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"),
cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"),
cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"),
input=parse_double(len(coalesce(cmd_line_norm, "")))
| adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where label AND quantile>0.99
| first_time_event cache_partitions=1 input_columns="dest_device_id,cmd_line"
| where first_time_dest_device_id_cmd_line
| eval start_time = timestamp,
end_time = timestamp,
entities = mvappend(dest_device_id, dest_user_id),
body = "TBD";

from security_content.

josehelps avatar josehelps commented on August 20, 2024

Each detection for SSA now has a test file as that CI will run: https://github.com/splunk/security-content/tree/develop/tests/endpoint as well as individual notebooks used for manual testing: https://github.com/splunk/security-content/tree/develop/notebooks closing this for now.

from security_content.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.