fix: count up `Event with hits` when aggregation/correlation rule #1384

fukusuket · 2024-07-08T17:19:27Z

What Changed

Test

csv-timeline/json-timeline diff check (compared with main branch)

No difference in the result file compared to the main branch.
https://github.com/Yamato-Security/hayabusa/actions/runs/9844009215

integration-test

All commands work properly.
https://github.com/Yamato-Security/hayabusa/actions/runs/9844007839

I would appreciate it if you could check it out when you have time🙏

fukusuket · 2024-07-08T17:23:24Z

aggregation rule

I confirmed that the Event with hit is counted up in the case of the issue #1375 (comment)

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml -w -q
Start time: 2024/07/09 02:21

Total event log files: 585
Total file size: 137.2 MB

Loading detection rules. Please wait.


Stable rules: 1 (100.00%)

Hayabusa rules: 1
Total detection rules: 1

Creating the channel filter. Please wait.

Evtx files loaded after channel filter: 241
Detection rules enabled after channel filter: 1

Output profile: standard

Scanning in progress. Please wait.

[00:00:00] 241 / 241   [========================================] 100%

Scanning finished. Please wait while the results are being saved.

Timestamp · RuleTitle · Level · Computer · Channel · EventID · RecordID · Details · ExtraFieldInfo
2016-09-20 01:50:06.513 +09:00 · PW Guessing · med · - · - · - · - · Count: 3558 ¦ IpAddress: 192.168.198.149 · -


Rule Authors:

╭─────────────────╮
│ Zach Mathis (1) │
╰─────────────────╯

Results Summary:

Events with hits / Total events: 3,558 / 26,341 (Data reduction: 22,783 events (86.49%))

Total | Unique detections: 1 | 1
Total | Unique critical detections: 0 (0.00%) | 0 (0.00%)
Total | Unique high detections: 0 (0.00%) | 0 (0.00%)
Total | Unique medium detections: 1 (100.00%) | 1 (0.00%)
Total | Unique low detections: 0 (0.00%) | 0 (100.00%)
Total | Unique informational detections: 0 (0.00%) | 0 (0.00%)

Dates with most total detections:
critical: n/a, high: n/a, medium: 2016-09-20 (1), low: n/a, informational: n/a

Top 5 computers with most unique detections:
critical: n/a
high: n/a
medium: n/a
low: n/a
informational: n/a

╭──────────────────────────────────────────────╮
│ Top critical alerts:        Top high alerts: │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top medium alerts:          Top low alerts:  │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ PW Guessing (1)             n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top informational alerts:                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
╰───────────────────────────╌──────────────────╯


Elapsed time: 00:00:00.472

fukusuket · 2024-07-08T17:28:18Z

correlation rule

I confirmed that the Event with hit is counted up in the case of the issue #1373 (comment)

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r test.yml -w -q
Start time: 2024/07/09 02:27

Total event log files: 585
Total file size: 137.2 MB

Loading detection rules. Please wait.


Undefined rules: 3 (100.00%)

Other rules: 3
Total detection rules: 3

Creating the channel filter. Please wait.

Evtx files loaded after channel filter: 241
Detection rules enabled after channel filter: 1

Output profile: standard

Scanning in progress. Please wait.

[00:00:00] 241 / 241   [========================================] 100%

Scanning finished. Please wait while the results are being saved.

Timestamp · RuleTitle · Level · Computer · Channel · EventID · RecordID · Details · ExtraFieldInfo
2016-09-20 01:50:06.477 +09:00 · Value Count TEST · info · - · - · - · - · Count: 2 ¦ SubStatus: 0xc000006a/0xc0000064 ¦ Computer: DESKTOP-M5SN04R · -

2021-05-20 21:49:53.378 +09:00 · Value Count TEST · info · - · - · - · - · Count: 2 ¦ SubStatus: 0xc000006a/0xc0000064 ¦ Computer: fs01.offsec.lan · -



Results Summary:

Events with hits / Total events: 3,564 / 26,341 (Data reduction: 22,777 events (86.47%))

Total | Unique detections: 2 | 1
Total | Unique critical detections: 0 (0.00%) | 0 (0.00%)
Total | Unique high detections: 0 (0.00%) | 0 (100.00%)
Total | Unique medium detections: 0 (0.00%) | 0 (0.00%)
Total | Unique low detections: 0 (0.00%) | 0 (0.00%)
Total | Unique informational detections: 2 (100.00%) | 1 (0.00%)

Dates with most total detections:
critical: n/a, high: n/a, medium: n/a, low: n/a, informational: 2021-05-20 (1)

Top 5 computers with most unique detections:
critical: n/a
high: n/a
medium: n/a
low: n/a
informational: n/a

╭──────────────────────────────────────────────╮
│ Top critical alerts:        Top high alerts: │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top medium alerts:          Top low alerts:  │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top informational alerts:                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Value Count TEST (2)        n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
╰───────────────────────────╌──────────────────╯


Elapsed time: 00:00:00.463

fukusuket · 2024-07-09T03:34:21Z

Top 5 computers with most unique detections shows only n/a but should include the correlation rule results

Sorry, I forgot the above case fix...😅 I'll try to address this in the next PR🙏

fukusuket · 2024-07-09T14:05:20Z

I also fixed #1342 (comment) 's case 1.(Multiple Channel/Computer/EventID)

Is it possible to put in the Channel and EventID info? When there are multiple values, we can separate them with ¦.

{
    "Timestamp": "2021-12-12 16:15:56.716 +09:00",
    "RuleTitle": "TEST_TITLE",
    "Level": "info",
    "Computer": "fs03vuln.offsec.lan ¦ rootdc1.offsec.lan",
    "Channel": "Security",
    "EventID": 4624,
    "RecordID": "-",
    "Details": {
        "Count": 33,
        "IpAddress": "10.23.123.11",
        "SubStatus": "null",
        "LogonType": 3
    },
    "ExtraFieldInfo": "-"
}

fukusuket · 2024-07-10T11:36:34Z

I also fixed #1342 (comment) 's case 3.(EvtxFile)

EvtxFile is also - but many users ask me how they can look up the evtx file from this alert so it would be nice to get this information as well. Again, separate by ¦ when there are multiple values.

% ./hayabusa json-timeline -d ../hayabusa-sample-evtx -r rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml -w -q -p super-verbose

{
    "Timestamp": "2016-09-20 01:50:06.513 +09:00",
    "RuleTitle": "PW Guessing",
    "Level": "med",
    "Computer": "DESKTOP-M5SN04R",
    "Channel": "Security",
    "EventID": 4625,
    "RuleAuthor": "Zach Mathis",
    "RuleModifiedDate": "2022/05/21",
    "Status": "stable",
    "RecordID": "-",
    "Details": {
        "Count": 3558,
        "IpAddress": "192.168.198.149"
    },
    "ExtraFieldInfo": "-",
    "MitreTactics": [
        "CredAccess,08. Credential Access"
    ],
    "MitreTags": [
        "T1110.003"
    ],
    "Provider": "-",
    "RuleCreationDate": "2021/12/20",
    "RuleFile": "Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml",
    "EvtxFile": "../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx"
}

fukusuket · 2024-07-10T12:40:35Z

I fixed #1342 (comment) 's case6(not displayed computers summary) and #1384 (comment).

Top 5 computers with most unique detections shows only n/a but should include the correlation rule results

% ./hayabusa json-timeline -d ../hayabusa-sample-evtx -r rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml -w -q -p super-verbose
...


Events with hits / Total events: 3,558 / 26,341 (Data reduction: 22,783 events (86.49%))

Total | Unique detections: 1 | 1
Total | Unique critical detections: 0 (0.00%) | 0 (0.00%)
Total | Unique high detections: 0 (0.00%) | 0 (0.00%)
Total | Unique medium detections: 1 (100.00%) | 1 (0.00%)
Total | Unique low detections: 0 (0.00%) | 0 (100.00%)
Total | Unique informational detections: 0 (0.00%) | 0 (0.00%)

Dates with most total detections:
critical: n/a, high: n/a, medium: 2016-09-20 (1), low: n/a, informational: n/a

Top 5 computers with most unique detections:
critical: n/a
high: n/a
medium: DESKTOP-M5SN04R (1)
low: n/a
informational: n/a

╭──────────────────────────────────────────────╮
│ Top critical alerts:        Top high alerts: │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top medium alerts:          Top low alerts:  │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ PW Guessing (1)             n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top informational alerts:                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
│ n/a                         n/a              │
╰───────────────────────────╌──────────────────╯

fukusuket · 2024-07-10T12:56:41Z

Some improvements to the output of the count rule are included in this pull request💪

YamatoSecurity · 2024-07-14T10:36:41Z

@fukusuket
Thanks! For the channel name, it is Security but I think it normally gets abbreviated to Sec. I think we should abbreviate things in the same way, what do you think?

{
    "Timestamp": "2016-09-20 01:50:06.513 +09:00",
    "RuleTitle": "PW Guessing",
    "Level": "med",
    "Computer": "DESKTOP-M5SN04R",
    "Channel": "Security",
    "EventID": 4625,
    "RuleAuthor": "Zach Mathis",
    "RuleModifiedDate": "2022/05/21",
    "Status": "stable",
    "RecordID": "-",
    "Details": {
        "Count": 3558,
        "IpAddress": "192.168.198.149"
    },
    "ExtraFieldInfo": "-",
    "MitreTactics": [
        "CredAccess,08. Credential Access"
    ],
    "MitreTags": [
        "T1110.003"
    ],
    "Provider": "-",
    "RuleCreationDate": "2021/12/20",
    "RuleFile": "Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml",
    "EvtxFile": "../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx"
}

fukusuket · 2024-07-14T11:55:47Z

Sorry🙏 I fixed channel abbreviation!

./hayabusa json-timeline -d ../hayabusa-sample-evtx -r rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml -w -q -p super-verbose
...

{
    "Timestamp": "2016-09-20 01:50:06.513 +09:00",
    "RuleTitle": "PW Guessing",
    "Level": "med",
    "Computer": "DESKTOP-M5SN04R",
    "Channel": "Sec",
    "EventID": 4625,
    "RuleAuthor": "Zach Mathis",
    "RuleModifiedDate": "2022/05/21",
    "Status": "stable",
    "RecordID": "-",
    "Details": {
        "Count": 3558,
        "IpAddress": "192.168.198.149"
    },
    "ExtraFieldInfo": "-",
    "MitreTactics": [
        "CredAccess,08. Credential Access"
    ],
    "MitreTags": [
        "T1110.003"
    ],
    "Provider": "-",
    "RuleCreationDate": "2021/12/20",
    "RuleFile": "Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml",
    "EvtxFile": "../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx"
}

YamatoSecurity

@fukusuket LGTM! Thanks so much!

fukusuket added 2 commits July 7, 2024 22:06

refactor: remove unused fields/params

79ce661

fix: count up events when agg/correlation rule matched event

2b60013

fukusuket self-assigned this Jul 8, 2024

fukusuket added the bug Something isn't working label Jul 8, 2024

fukusuket added this to the v2.17.0 milestone Jul 8, 2024

fukusuket marked this pull request as ready for review July 8, 2024 17:32

fukusuket requested review from hitenkoku and YamatoSecurity July 8, 2024 17:33

hitenkoku approved these changes Jul 9, 2024

View reviewed changes

fukusuket added 5 commits July 9, 2024 22:19

chg: output channel/event_id/computer when agg/correlation result

12b3f6e

chg: output channel/event_id/computer when agg/correlation result

ff28335

chg: output channel/event_id/computer when agg/correlation result

932674d

chg: sort computer/event_id/channel multiple val

23fe401

chg: sort computer/event_id/channel multiple val

c55e3e9

fukusuket added 2 commits July 10, 2024 08:34

refactor: remove duplicated code

d1ea60e

chg: output evtx_file_path when agg/correlation rule

e0a90a5

fix: Top 5 computers with most unique detections's output

a8f9236

fix: Top 5 computers with most unique detections's output

80d219d

fukusuket and others added 3 commits July 11, 2024 22:16

fix: remove debug print

d69134a

update changelog

b641517

bump

11dffd1

fix: channel abbreviation

62454b9

YamatoSecurity approved these changes Jul 15, 2024

View reviewed changes

YamatoSecurity merged commit 25c1200 into main Jul 15, 2024
7 of 8 checks passed

YamatoSecurity deleted the 1375-agg-condition-rule-not-count-up branch July 15, 2024 00:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: count up `Event with hits` when aggregation/correlation rule #1384

fix: count up `Event with hits` when aggregation/correlation rule #1384

fukusuket commented Jul 8, 2024 •

edited

Loading

fukusuket commented Jul 8, 2024 •

edited

Loading

fukusuket commented Jul 8, 2024

fukusuket commented Jul 9, 2024

fukusuket commented Jul 9, 2024 •

edited

Loading

fukusuket commented Jul 10, 2024 •

edited

Loading

fukusuket commented Jul 10, 2024 •

edited

Loading

fukusuket commented Jul 10, 2024

YamatoSecurity commented Jul 14, 2024

fukusuket commented Jul 14, 2024

YamatoSecurity left a comment

fix: count up Event with hits when aggregation/correlation rule #1384

fix: count up Event with hits when aggregation/correlation rule #1384

Conversation

fukusuket commented Jul 8, 2024 • edited Loading

What Changed

Test

csv-timeline/json-timeline diff check (compared with main branch)

integration-test

fukusuket commented Jul 8, 2024 • edited Loading

aggregation rule

fukusuket commented Jul 8, 2024

correlation rule

fukusuket commented Jul 9, 2024

fukusuket commented Jul 9, 2024 • edited Loading

fukusuket commented Jul 10, 2024 • edited Loading

fukusuket commented Jul 10, 2024 • edited Loading

fukusuket commented Jul 10, 2024

YamatoSecurity commented Jul 14, 2024

fukusuket commented Jul 14, 2024

YamatoSecurity left a comment

Choose a reason for hiding this comment

fix: count up `Event with hits` when aggregation/correlation rule #1384

fix: count up `Event with hits` when aggregation/correlation rule #1384

fukusuket commented Jul 8, 2024 •

edited

Loading

fukusuket commented Jul 8, 2024 •

edited

Loading

fukusuket commented Jul 9, 2024 •

edited

Loading

fukusuket commented Jul 10, 2024 •

edited

Loading

fukusuket commented Jul 10, 2024 •

edited

Loading