-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added a Windows.Sigma.Base.CaptureTestSet artifact (#41)
This artifact helps to capture test sets that can be used in development of Sigma rules.
- Loading branch information
Showing
10 changed files
with
193 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| Name: Windows.Sigma.Base.CaptureTestSet | ||
| ImportConfigs: | ||
| - config/windows_base.yaml | ||
|
|
||
| Preamble: | | ||
| name: Windows.Sigma.Base.CaptureTestSet | ||
| description: | | ||
| This artifact captures a test set of the log sources defined by | ||
| Windows.Sigma.Base. It is used to acquire a dataset for the | ||
| `SigmaStudio` notebook. | ||
| type: CLIENT | ||
| parameters: | ||
| - name: ROOT | ||
| description: The Event Log Directory we use to read all logs | ||
| default: C:/Windows/System32/WinEvt/Logs/ | ||
| - name: LogSourceFilter | ||
| description: Only capture log sources that match this regex. | ||
| type: regex | ||
| default: . | ||
| - name: SelectedLogSources | ||
| description: Set to capture only those log sources. | ||
| type: multichoice | ||
| choices: | ||
| {{- range .ImportedLogSources }} | ||
| - "{{ .Name }}" | ||
| {{- end }} | ||
| - name: DateAfter | ||
| description: "search for events after this date. YYYY-MM-DDTmm:hh:ss Z" | ||
| type: timestamp | ||
| - name: DateBefore | ||
| description: "search for events before this date. YYYY-MM-DDTmm:hh:ss Z" | ||
| type: timestamp | ||
| - name: EventRegex | ||
| description: Only capture events that match this regex (the event is converted to JSON first). | ||
| type: regex | ||
| default: . | ||
| imports: | ||
| - Windows.Sigma.Base | ||
| QueryTemplate: | | ||
| sources: | ||
| - name: MatchingSources | ||
| query: | | ||
| SELECT _key AS SourceName | ||
| FROM items(item=LogSources) | ||
| WHERE SourceName =~ LogSourceFilter | ||
| AND if(condition=SelectedLogSources, then=SourceName in SelectedLogSources, else=TRUE) | ||
| - query: | | ||
| SELECT * FROM foreach(row={ | ||
| SELECT _key AS SourceName, _value AS Query | ||
| FROM items(item=LogSources) | ||
| WHERE SourceName =~ LogSourceFilter | ||
| AND if(condition=SelectedLogSources, then=SourceName in SelectedLogSources, else=TRUE) | ||
| }, query={ | ||
| SELECT * FROM foreach(row={ | ||
| SELECT * FROM items(item={ | ||
| SELECT * FROM query(query=Query, copy_env=TRUE) | ||
| }) | ||
| WHERE _value =~ EventRegex | ||
| }, column="_value") | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "io/ioutil" | ||
| "os" | ||
|
|
||
| "github.com/Velocidex/yaml/v2" | ||
| kingpin "github.com/alecthomas/kingpin/v2" | ||
| ) | ||
|
|
||
| var ( | ||
| profile_cmd = app.Command("gen_profiles", "Generate profile JSON") | ||
| profile_cmd_output = profile_cmd.Flag("output", "File to write the profile").Required().String() | ||
| profile_cmd_args = profile_cmd.Arg("configs", "Config files to read").Required().Strings() | ||
| ) | ||
|
|
||
| func doProfile() error { | ||
| profiles := make(map[string]*Config) | ||
|
|
||
| for _, config_file := range *profile_cmd_args { | ||
| fd, err := os.Open(config_file) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| data, err := ioutil.ReadAll(fd) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| conf := &Config{} | ||
| err = yaml.Unmarshal(data, conf) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| profiles[conf.Name] = conf | ||
| } | ||
|
|
||
| serialized, err := json.Marshal(profiles) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| outfd, err := os.OpenFile(*profile_cmd_output, | ||
| os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer outfd.Close() | ||
|
|
||
| _, err = outfd.Write(serialized) | ||
| return err | ||
| } | ||
|
|
||
| func init() { | ||
| command_handlers = append(command_handlers, func(command string) bool { | ||
| switch command { | ||
| case profile_cmd.FullCommand(): | ||
| err := doProfile() | ||
| kingpin.FatalIfError(err, "Compiling profiles") | ||
|
|
||
| default: | ||
| return false | ||
| } | ||
| return true | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters