detections.spec.json

{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "description": "schema for detections",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the detection",
      "examples": [
        "Patrick Bareiss, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "A detailed description of the detection",
      "examples": [
        "dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump."
      ],
      "type": "string"
    },
    "how_to_implement": {
      "$id": "#/properties/how_to_implement",
      "default": "",
      "description": "information about how to implement. Only needed for non standard implementations.",
      "examples": [
        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "known_false_positives": {
      "$id": "#/properties/knwon_false_positives",
      "default": "",
      "description": "known false postives",
      "examples": [
        "Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual."
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "examples": [
        "Access LSASS Memory for Dump Creation"
      ],
      "title": "Name of detection",
      "type": "string"
    },
    "references": {
      "$id": "#/properties/references",
      "additionalItems": true,
      "default": [],
      "description": "A list of references for this detection",
      "examples": [
        [
          "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
        ]
      ],
      "items": {
        "$id": "#/properties/references/items",
        "default": "",
        "description": "An explanation about the purpose of this instance.",
        "examples": [
          "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
        ],
        "title": "The Items Schema",
        "type": "string"
      },
      "type": "array"
    },
    "search": {
      "$id": "#/properties/search",
      "default": "",
      "description": "The Splunk search for the detection",
      "examples": [
        "`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`"
      ],
      "type": "string"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytic_story": "credential_dumping",
          "kill_chain_phases": "Action on Objectives",
          "mitre_attack_id": "T1078.004",
          "cis20": "CIS 13",
          "nist": "DE.DP",
          "security domain": "network",
          "asset_type": "AWS Instance",
          "risk_object": "user",
          "risk_object_type": "network_artifacts",
          "risk score": "60",
          "custom_key": "custom_value"
        }
      ],
      "minItems": 1,
      "type": "object",
      "uniqueItems": true
    },
    "type": {
      "$id": "#/properties/type",
      "default": "",
      "description": "type of detection",
      "examples": [
        "Anomaly"
      ],
      "items": {
        "enum": [
          "TTP",
          "Anomaly",
          "Hunting",
          "Baseline",
          "Investigation",
          "Correlation"
        ],
        "type": "string"
      },
      "type": "string"
    },
    "datamodel": {
      "$id": "#/properties/datamodel",
      "default": "",
      "description": "datamodel used in the search",
      "examples": [
        "Endpoint"
      ],
      "items": {
        "enum": [
          "Endpoint",
          "Network_Traffic",
          "Authentication",
          "Change",
          "Change_Analysis",
          "Email",
          "Endpoint",
          "Network_Resolution",
          "Network_Sessions",
          "Network_Traffic",
          "UEBA",
          "Updates",
          "Vulnerabilities",
          "Web"
        ],
        "type": "string"
      },
      "type": "array"
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of detection, e.g. 1 or 2 ...",
      "examples": [
        2
      ],
      "type": "integer"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "datamodel",
    "description",
    "type",
    "author",
    "search",
    "known_false_positives",
    "tags"
  ],
  "title": "Detection Schema",
  "type": "object"
}