Skip to content

Commit 0278dd8

Browse files
gabriellandaugabriellandau
authored
.NET Metadata Hashes (#307)
* Add .NET PE metadata hashes * Bugfix * Switching sections and streams over to * It built? * More-thorough cleaning * Fix bad paste * Update Makefile * Fix build * Tests pass * Reuse existing hash field * Move new .NET fields from file.Ext to file.pe.Ext since they are PE-specific
1 parent 53a1938 commit 0278dd8

File tree

9 files changed

+262
-1
lines changed

9 files changed

+262
-1
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ clean:
7474
rm -rf $(ROOT_DIR)/build
7575
rm -rf $(GO_TOOLS)
7676
rm -rf $(VENV_DIR)
77+
find $(ROOT_DIR)/package/endpoint/data_stream -name fields.yml -delete
7778

7879
# create package/endpoint/docs/README.md based on the template file, and the fields inputs
7980
$(DOC_TARGET): doc_templates/endpoint/docs/* $(PKG_FIELDS_TARGETS) $(MANIFESTS)

‎custom_schemas/custom_file.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,3 +408,8 @@
408408
This is used to identify the team or vendor of a software product. The field is
409409
relevant to Apple *OS only.'
410410
example: EQHXZ8M8AV
411+
412+
- name: pe
413+
level: custom
414+
type: object
415+
description: PE fields

‎custom_schemas/custom_hash.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,5 @@
1818
- macro.collection
1919
- macro.project_file
2020
- macro.stream
21+
- pe.Ext.streams
22+
- pe.Ext.sections

‎custom_schemas/custom_pe.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,49 @@
1111
as: mapped_pe
1212
- at: memory_region
1313
as: memory_pe
14+
fields:
15+
- name: Ext.dotnet
16+
level: custom
17+
type: boolean
18+
description: Whether this file is a .NET PE
19+
example: "true"
20+
21+
- name: Ext.sections
22+
level: custom
23+
type: object
24+
short: The file's sections, if it is a PE
25+
description: >
26+
The file's relevant sections, if it is a PE
27+
28+
- name: Ext.sections.name
29+
level: custom
30+
type: keyword
31+
example: ".reloc"
32+
description: >
33+
The section's name
34+
35+
- name: Ext.sections.hash
36+
level: custom
37+
type: object
38+
description: >
39+
Hashes
40+
41+
- name: Ext.streams
42+
level: custom
43+
type: object
44+
short: The file's streams, if it is a PE
45+
description: >
46+
The file's streams, if it is a PE
47+
48+
- name: Ext.streams.name
49+
level: custom
50+
type: keyword
51+
example: ".reloc"
52+
description: >
53+
The stream's name
54+
55+
- name: Ext.streams.hash
56+
level: custom
57+
type: object
58+
description: >
59+
Hashes

‎custom_subsets/elastic_endpoint/alerts/malware_event.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -587,6 +587,23 @@ fields:
587587
imphash: {}
588588
original_file_name: {}
589589
product: {}
590+
Ext:
591+
fields:
592+
dotnet: {}
593+
sections:
594+
fields:
595+
name: {}
596+
hash:
597+
fields:
598+
md5: {}
599+
sha256: {}
600+
streams:
601+
fields:
602+
name: {}
603+
hash:
604+
fields:
605+
md5: {}
606+
sha256: {}
590607
size: {}
591608
target_path: {}
592609
type: {}

‎package/endpoint/data_stream/alerts/fields/fields.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3841,6 +3841,60 @@
38413841
default_field: false
38423842
description: Full path to the file, including the file name. It should include the drive letter, when appropriate.
38433843
example: /home/alice/example.png
3844+
- name: pe.Ext.dotnet
3845+
level: custom
3846+
type: boolean
3847+
description: Whether this file is a .NET PE
3848+
example: 'true'
3849+
default_field: false
3850+
- name: pe.Ext.sections
3851+
level: custom
3852+
type: object
3853+
description: The file's relevant sections, if it is a PE
3854+
default_field: false
3855+
- name: pe.Ext.sections.hash.md5
3856+
level: extended
3857+
type: keyword
3858+
ignore_above: 1024
3859+
description: MD5 hash.
3860+
default_field: false
3861+
- name: pe.Ext.sections.hash.sha256
3862+
level: extended
3863+
type: keyword
3864+
ignore_above: 1024
3865+
description: SHA256 hash.
3866+
default_field: false
3867+
- name: pe.Ext.sections.name
3868+
level: custom
3869+
type: keyword
3870+
ignore_above: 1024
3871+
description: The section's name
3872+
example: .reloc
3873+
default_field: false
3874+
- name: pe.Ext.streams
3875+
level: custom
3876+
type: object
3877+
description: The file's streams, if it is a PE
3878+
default_field: false
3879+
- name: pe.Ext.streams.hash.md5
3880+
level: extended
3881+
type: keyword
3882+
ignore_above: 1024
3883+
description: MD5 hash.
3884+
default_field: false
3885+
- name: pe.Ext.streams.hash.sha256
3886+
level: extended
3887+
type: keyword
3888+
ignore_above: 1024
3889+
description: SHA256 hash.
3890+
default_field: false
3891+
- name: pe.Ext.streams.name
3892+
level: custom
3893+
type: keyword
3894+
ignore_above: 1024
3895+
description: The stream's name
3896+
example: .reloc
3897+
default_field: false
38443898
- name: pe.company
38453899
level: extended
38463900
type: keyword

‎package/endpoint/data_stream/alerts/sample_event.json‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,35 @@
117117
"pe": {
118118
"file_version": "0.0.0.0",
119119
"description": " ",
120-
"original_file_name": "5t5mpwxc.dll"
120+
"original_file_name": "5t5mpwxc.dll",
121+
"Ext": {
122+
"dotnet": true,
123+
"streams": [
124+
{
125+
"name": "#~",
126+
"hash": {
127+
"md5": "debf08c09d49337fbe7acde4d3749242",
128+
"sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
129+
}
130+
},
131+
{
132+
"name": "#Blob",
133+
"hash": {
134+
"md5": "debf08c09d49337fbe7acde4d3749242",
135+
"sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
136+
}
137+
}
138+
],
139+
"sections": [
140+
{
141+
"name": ".reloc",
142+
"hash": {
143+
"md5": "debf08c09d49337fbe7acde4d3749242",
144+
"sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
145+
}
146+
}
147+
]
148+
}
121149
},
122150
"name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
123151
"hash": {

‎package/endpoint/docs/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -520,6 +520,15 @@ sent by the endpoint.
520520
| file.name | Name of the file including the extension, without the directory. | keyword |
521521
| file.owner | File owner's username. | keyword |
522522
| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword |
523+
| file.pe.Ext.dotnet | Whether this file is a .NET PE | boolean |
524+
| file.pe.Ext.sections | The file's relevant sections, if it is a PE | object |
525+
| file.pe.Ext.sections.hash.md5 | MD5 hash. | keyword |
526+
| file.pe.Ext.sections.hash.sha256 | SHA256 hash. | keyword |
527+
| file.pe.Ext.sections.name | The section's name | keyword |
528+
| file.pe.Ext.streams | The file's streams, if it is a PE | object |
529+
| file.pe.Ext.streams.hash.md5 | MD5 hash. | keyword |
530+
| file.pe.Ext.streams.hash.sha256 | SHA256 hash. | keyword |
531+
| file.pe.Ext.streams.name | The stream's name | keyword |
523532
| file.pe.company | Internal company name of the file, provided at compile-time. | keyword |
524533
| file.pe.description | Internal description of the file, provided at compile-time. | keyword |
525534
| file.pe.file_version | Internal version of the file, provided at compile-time. | keyword |

‎schemas/v1/alerts/malware_event.yaml‎

Lines changed: 99 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)