Log4Forge Log4Shell LogForceShell

[josehelps]

Splunk Security Content PR

What did you change:

• adds a new SSA detection called: Windows Powershell Connect to Internet With Hidden Window, also successfully pasts preflight test:

python test_detection.py srs_e2e ~/splunk/security_content/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
2022-02-14 14:00:41,894 INFO - running end-to-end test in SRS on /Users/jhernandez/splunk/security_content/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
2022-02-14 14:00:41,906 INFO - checking SRS compatibility of /Users/jhernandez/splunk/security_content/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
2022-02-14 14:00:43,025 INFO - downloaded attack data sourcetype=WinEventLog:Security to /tmp/detection_check/477e068e-8b6d-11ec-b6c1-81af21670352/events.raw: url=https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
2022-02-14 14:00:43,026 INFO - wrote raw events to /tmp/detection_check/477e068e-8b6d-11ec-b6c1-81af21670352/events.raw
2022-02-14 14:00:43,026 INFO - parsing events (sourcetype=WinEventLog:Security) from file: /tmp/detection_check/477e068e-8b6d-11ec-b6c1-81af21670352/events.raw
2022-02-14 14:02:05,674 INFO - parsed events. inputfiles=1 total_events=107 resolver=107 training=0 errors=0
2022-02-14 14:02:05,674 INFO - wrote parsed events to /tmp/detection_check/477e068e-8b6d-11ec-b6c1-81af21670352/events.parsed.jsonl
2022-02-14 14:02:08,178 INFO - wrote 107 decorated events
2022-02-14 14:02:08,180 INFO - writing anomalies to /tmp/detection_check/477e068e-8b6d-11ec-b6c1-81af21670352/anomalies.json
2022-02-14 14:02:10,375 INFO - MATCHED 477e068e-8b6d-11ec-b6c1-81af21670352 anomaly_count=1 event_count=107 file=/Users/jhernandez/splunk/security_content/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
2022-02-14 14:02:10,406 INFO - PASSED ssa___windows_powershell_connect_to_internet_with_hidden_window.yml anomalies=1 decorated_events=107
2022-02-14 14:02:10,406 INFO - overall status=SUCCESS detections=1 ok=1 failed=0 errors=0
2022-02-14 14:02:10,406 INFO - details written to /tmp/detection_check/477e068e-8b6d-11ec-b6c1-81af21670352/anomalies.json

• adds new SSA detection called: Windows Powershell DownloadFile, successfully tested in SPS:

Make sure that CI/CD detection-testing and build-and-validate jobs passed ✅ .

For Reviewers:

• Verify CI/CD jobs have passed without errors.
• Validate SPL logic.
• Validate tags, description, and how to implement.
• Validate name patches <platform>_<mitre att&ck technique>_<short description>
• Verify references match analytic.
• Is there an Atomic Test?