feat: extract PowerShell Classic data fields option #1220
Conversation
Test(default option)When the option was not enabled, I confirmed that there were no differences with the results of 2.10.1. json-timline |
Test(benchmark)https://github.com/NextronSystems/evtx-baseline/releases/tag/v0.7
(The reason there is a difference in the number of detections is because the Data field has been replaced. |
Known issueThe data of EID:800 of Only one Data field and Some custom? field(There are usually 3 Data fields) Only one Data field(There are usually 3 Data fields) |
|
The option is tentatively set to |
|
@fukusuket Look great! Thank you! Just one thing though, it would be nice if we can still detect on the original By the way, is it possible to specify with eventkey aliases certain fields to output in the |
|
@YamatoSecurity
Yes, I agree that it is better! In order to be able to detect the
Yes, you can specify it in Details (but it's not output right now, so check it...). Also, the key is only separated by "\n\t" and "=", so it is not hard coded. |
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #1220 +/- ##
==========================================
+ Coverage 83.34% 83.48% +0.14%
==========================================
Files 26 27 +1
Lines 23835 24082 +247
==========================================
+ Hits 19866 20106 +240
- Misses 3969 3976 +7 ☔ View full report in Codecov by Sentry. |
|
@YamatoSecurity |
Test(rule details extraction)I confirmed that the field after extraction is output to details as follows using the following rules. author: test
date: 2023/11/24
modified: 2023/11/24
title: 'PwSh Classic TEST'
details: 'HostVersion: %HostVersion% ¦ HostApplication: %HostApplication%'
id: ac2ae63b-83e6-4d06-aeaf-07409bda92c9
level: informational
status: test
logsource:
product: windows
service: powershell
detection:
selection:
Channel: 'Windows PowerShell'
selection_2:
- EventID: 400
- EventID: 403
- EventID: 600
- EventID: 800
selection_3:
HostApplication|contains: ' -nop '
condition: selection and selection_2 and selection_3
ruletype: Hayabusa{
"Timestamp": "2021-10-20 23:39:26.000 +09:00",
"Computer": "FS03.offsec.lan",
"Channel": "PwShClassic",
"EventID": 400,
"Level": "info",
"RecordID": 132,
"RuleTitle": "PwSh Classic TEST",
"Details": {
"HostApplication": "powershell.exe -NoP -C C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump (Get-Process lsass).Id \\Windows\\Temp\\vtnr8kff.dmp full;Wait-Process -Id (Get-Process rundll32).id",
"HostVersion": "4.0"
},
"ExtraFieldInfo": {
"CommandLine": "",
"CommandName": "",
"CommandPath": "",
"CommandType": "",
"Data": "Available",
"Data": "NewEngineState=Available\\r\\n\\tPreviousEngineState=None\\r\\n\\r\\n\\tSequenceNumber=13\\r\\n\\r\\n\\tHostName=ConsoleHost\\r\\n\\tHostVersion=4.0\\r\\n\\tHostId=63c2be9c-cd2c-46d7-ac07-01a9e98f2400\\r\\n\\tHostApplication=powershell.exe -NoP -C C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump (Get-Process lsass).Id \\Windows\\Temp\\vtnr8kff.dmp full;Wait-Process -Id (Get-Process rundll32).id\\r\\n\\tEngineVersion=4.0\\r\\n\\tRunspaceId=1668d864-c13c-442c-bf70-3fe6a4dee2ca\\r\\n\\tPipelineId=\\r\\n\\tCommandName=\\r\\n\\tCommandType=\\r\\n\\tScriptName=\\r\\n\\tCommandPath=\\r\\n\\tCommandLine=",
"Data": "None",
"HostId": "63c2be9c-cd2c-46d7-ac07-01a9e98f2400",
"HostName": "ConsoleHost",
"NewEngineState": "Available",
"PipelineId": "",
"PreviousEngineState": "None",
"RunspaceId": "1668d864-c13c-442c-bf70-3fe6a4dee2ca",
"ScriptName": "",
"SequenceNumber": 13
}
} |
Test(benchmark)https://github.com/NextronSystems/evtx-baseline/releases/tag/v0.8
|
fukusuket
deleted the
1201-feat-extract-powershell-classic-data-fileds
branch
What Changed
400,403,600:Event.EventData.Data[2]field800:Event.EventData.Data[1]fieldEvent.EventData.Datausing the following logic.\n\t=(only first=)--no-pwsh-field-extractionoptionEvidence
Enviroment
Test(basic extraction)
Test EID:400
./hayabusa json-timeline -w -d ../data -r test.yml --include-eid 400 -o 400.json --field-data-extraction -CTest EID:403
% ./hayabusa json-timeline -w -d ../data -r test.yml --include-eid 403 -o 403.json --field-data-extractionTest EID:600
% ./hayabusa json-timeline -w -d ../data -r test.yml --include-eid 600 -o 600.json --field-data-extractionTest EID:800
% ./hayabusa json-timeline -w -d ../data -r test.yml --include-eid 800 -o 800.json --field-data-extraction