Detection fixes

detections/cloud/aws_ecr_container_scanning_findings_high.yml

@@ -1,7 +1,7 @@
 name: AWS ECR Container Scanning Findings High
 id: 62721bd2-1d82-4623-b6e6-aac170014423
 version: 1
-date: '2021-08-17'
+date: '2022-06-21'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel: []
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
   requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description
   | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time)
-  as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName,
+  as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName,
   src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_high_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This

detections/cloud/aws_ecr_container_scanning_findings_medium.yml

@@ -15,7 +15,7 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description
   | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime
   max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image,
-  user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
+   userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.

detections/endpoint/office_document_executing_macro_code.yml

@@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious office documen
   or other malware component. It is really good practice to disable macro by default
   to avoid automatically execute macro code while opening or closing a office document
   files.
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
+search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
   ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
   as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
   by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`

tests/application/path_traversal_spl_injection.test.yml

@@ -10,3 +10,4 @@ tests:
     data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt
     source: c:\opt\splunk\var\log\splunk\splunkd_ui_access.log
     sourcetype: splunkd_ui_access
+    custom_index: _internal

tests/application/splunk_dos_via_malformed_s2s_request.test.yml

@@ -11,3 +11,4 @@ tests:
     source: /opt/splunk/var/log/splunk/splunkd.log
     sourcetype: splunkd
     update_timestamp: true
+    custom_index: _internal