Skip to content

Commit 6c0dd97

Browse files
scudettescudette
authored
Add aliases to artifact references (#1004)
1 parent 5ca2098 commit 6c0dd97

12 files changed

+1254
-239
lines changed

‎content/artifact_references/pages/elastic.events.clients.md

+32-16
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,28 @@ hidden: true
44
tags: [Server Event Artifact]
55
---
66

7-
This server monitoring artifact will watch a selection of client
8-
monitoring artifacts for new events and push those to an elastic
9-
index.
7+
This server monitoring artifact will watch a selection of client or
8+
server monitoring artifacts for new events and push those to an
9+
elastic index.
1010

1111
NOTE: You must ensure you are collecting these artifacts from the
12-
clients by adding them to the "Client Events" GUI.
12+
clients by adding them to the "Client Events" GUI, or for server
13+
artifacts, the "Server Events" GUI.
1314

1415

15-
```yaml
16-
name: Elastic.Events.Clients
16+
<pre><code class="language-yaml">
17+
name: Elastic.Events.Upload
18+
aliases:
19+
- Elastic.Events.Clients
20+
1721
description: |
18-
This server monitoring artifact will watch a selection of client
19-
monitoring artifacts for new events and push those to an elastic
20-
index.
22+
This server monitoring artifact will watch a selection of client or
23+
server monitoring artifacts for new events and push those to an
24+
elastic index.
2125

2226
NOTE: You must ensure you are collecting these artifacts from the
23-
clients by adding them to the "Client Events" GUI.
27+
clients by adding them to the "Client Events" GUI, or for server
28+
artifacts, the "Server Events" GUI.
2429

2530
type: SERVER_EVENT
2631

@@ -30,14 +35,20 @@ parameters:
3035
- name: Username
3136
- name: Password
3237
- name: APIKey
33-
- name: artifactsToWatch
38+
- name: ClientArtifactsToWatch
3439
type: artifactset
3540
artifact_type: CLIENT_EVENT
3641
default: |
3742
Artifact
3843
Windows.Detection.PsexecService
3944
Windows.Events.ProcessCreation
4045
Windows.Events.ServiceCreation
46+
- name: ServerArtifactsToWatch
47+
type: artifactset
48+
artifact_type: SERVER_EVENT
49+
default: |
50+
Artifact
51+
Server.Audit.Logs
4152
- name: DisableSSLSecurity
4253
type: bool
4354
description: Disable SSL certificate verification
@@ -56,17 +67,21 @@ parameters:
5667

5768
sources:
5869
- query: |
59-
LET artifacts_to_watch = SELECT Artifact
60-
FROM artifactsToWatch
61-
WHERE log(message="Uploading artifact " + Artifact + " to Elastic")
70+
LET artifacts_to_watch = SELECT * FROM chain(
71+
a={SELECT Artifact FROM ClientArtifactsToWatch},
72+
b={SELECT Artifact FROM ServerArtifactsToWatch})
73+
WHERE NOT Artifact =~ "Elastic.Events.Upload"
74+
AND log(message="Uploading artifact " + Artifact + " to Elastic")
75+
76+
LET s = scope()
6277

6378
LET events = SELECT * FROM foreach(
6479
row=artifacts_to_watch,
6580
async=TRUE, // Required for event queries in foreach()
6681
query={
6782
SELECT *, "Artifact_" + Artifact as _index,
6883
Artifact,
69-
client_info(client_id=ClientId).os_info.hostname AS Hostname,
84+
client_info(client_id=s.ClientId || "server").os_info.hostname AS Hostname,
7085
timestamp(epoch=now()) AS timestamp
7186
FROM watch_monitoring(artifact=Artifact)
7287
})
@@ -85,4 +100,5 @@ sources:
85100
disable_ssl_security=DisableSSLSecurity,
86101
type="ClientEvents")
87102

88-
```
103+
</code></pre>
104+

‎content/artifact_references/pages/linux.detection.yara.glob.md

+193
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
---
2+
title: Linux.Detection.Yara.Glob
3+
hidden: true
4+
tags: [Client Artifact]
5+
---
6+
7+
This artifact returns a list of target files then runs Yara over the target
8+
list.
9+
10+
There are 2 kinds of Yara rules that can be deployed:
11+
12+
1. Url link to a yara rule.
13+
2. or a Standard Yara rule attached as a parameter.
14+
15+
Only one method of Yara will be applied and search order is as above.
16+
17+
The artifact leverages Glob for search so relevant filters can be applied
18+
including Glob, Size and date. Date filters will target files with a timestamp
19+
before LatestTime and after EarliestTime. The artifact also has an option to
20+
upload any files with Yara hits.
21+
22+
Some examples of path glob may include:
23+
24+
* Specific binary: `/usr/bin/ls`
25+
* Wildcards: `/var/www/*.js`
26+
* More wildcards: `/var/www/**/*.js`
27+
* Multiple extentions: `/var/www/*\.{php,aspx,js,html}`
28+
* Windows: `C:/Users/**/*.{exe,dll,ps1,bat}`
29+
* Windows: `C:\Users\**\*.{exe,dll,ps1,bat}`
30+
31+
NOTE: this artifact runs the glob plugin with the nosymlink switch turned on.
32+
This will NOT follow any symlinks and may cause unexpected results if
33+
unknowingly targeting a folder with symlinks.
34+
If upload is selected NumberOfHits is redundant and not advised as hits are
35+
grouped by path to ensure files only downloaded once.
36+
37+
38+
<pre><code class="language-yaml">
39+
name: Generic.Detection.Yara.Glob
40+
author: Matt Green - @mgreen27
41+
description: |
42+
This artifact returns a list of target files then runs Yara over the target
43+
list.
44+
45+
There are 2 kinds of Yara rules that can be deployed:
46+
47+
1. Url link to a yara rule.
48+
2. or a Standard Yara rule attached as a parameter.
49+
50+
Only one method of Yara will be applied and search order is as above.
51+
52+
The artifact leverages Glob for search so relevant filters can be applied
53+
including Glob, Size and date. Date filters will target files with a timestamp
54+
before LatestTime and after EarliestTime. The artifact also has an option to
55+
upload any files with Yara hits.
56+
57+
Some examples of path glob may include:
58+
59+
* Specific binary: `/usr/bin/ls`
60+
* Wildcards: `/var/www/*.js`
61+
* More wildcards: `/var/www/**/*.js`
62+
* Multiple extentions: `/var/www/*\.{php,aspx,js,html}`
63+
* Windows: `C:/Users/**/*.{exe,dll,ps1,bat}`
64+
* Windows: `C:\Users\**\*.{exe,dll,ps1,bat}`
65+
66+
NOTE: this artifact runs the glob plugin with the nosymlink switch turned on.
67+
This will NOT follow any symlinks and may cause unexpected results if
68+
unknowingly targeting a folder with symlinks.
69+
If upload is selected NumberOfHits is redundant and not advised as hits are
70+
grouped by path to ensure files only downloaded once.
71+
72+
aliases:
73+
- Windows.Detection.Yara.Glob
74+
- Linux.Detection.Yara.Glob
75+
- MacOS.Detection.Yara.Glob
76+
77+
type: CLIENT
78+
parameters:
79+
- name: PathGlob
80+
description: Only file names that match this glob will be scanned.
81+
default: /usr/bin/ls
82+
- name: SizeMax
83+
description: maximum size of target file.
84+
type: int64
85+
- name: SizeMin
86+
description: minimum size of target file.
87+
type: int64
88+
- name: UploadHits
89+
type: bool
90+
- name: DateAfter
91+
type: timestamp
92+
description: "search for events after this date. YYYY-MM-DDTmm:hh:ssZ"
93+
- name: DateBefore
94+
type: timestamp
95+
description: "search for events before this date. YYYY-MM-DDTmm:hh:ssZ"
96+
- name: YaraUrl
97+
description: If configured will attempt to download Yara rules form Url
98+
type: upload
99+
- name: YaraRule
100+
type: yara
101+
description: Final Yara option and the default if no other options provided.
102+
default: |
103+
rule IsELF:TestRule {
104+
meta:
105+
author = "the internet"
106+
date = "2021-05-03"
107+
description = "A simple ELF rule to test yara features"
108+
condition:
109+
uint32(0) == 0x464c457f
110+
}
111+
- name: NumberOfHits
112+
description: This artifact will stop by default at one hit. This setting allows additional hits
113+
default: 1
114+
type: int
115+
- name: ContextBytes
116+
description: Include this amount of bytes around hit as context.
117+
default: 0
118+
type: int
119+
120+
sources:
121+
- query: |
122+
-- check which Yara to use
123+
LET yara_rules &lt;= YaraUrl || YaraRule
124+
125+
-- time testing
126+
LET time_test(stamp) =
127+
if(condition= DateBefore AND DateAfter,
128+
then= stamp &lt; DateBefore AND stamp &gt; DateAfter,
129+
else=
130+
if(condition=DateBefore,
131+
then= stamp &lt; DateBefore,
132+
else=
133+
if(condition= DateAfter,
134+
then= stamp &gt; DateAfter,
135+
else= True
136+
)))
137+
138+
-- first find all matching glob
139+
LET files = SELECT OSPath, Name, Size, Mtime, Atime, Ctime, Btime
140+
FROM glob(globs=PathGlob,nosymlink='True')
141+
WHERE
142+
NOT IsDir AND NOT IsLink
143+
AND if(condition=SizeMin,
144+
then= SizeMin &lt; Size,
145+
else= True)
146+
AND if(condition=SizeMax,
147+
then=SizeMax &gt; Size,
148+
else= True)
149+
AND
150+
( time_test(stamp=Mtime)
151+
OR time_test(stamp=Atime)
152+
OR time_test(stamp=Ctime)
153+
OR time_test(stamp=Btime))
154+
155+
-- scan files and prepare hit metadata
156+
LET hits = SELECT * FROM foreach(row=files,
157+
query={
158+
SELECT
159+
OSPath,
160+
File.Size as Size,
161+
Mtime, Atime, Ctime, Btime,
162+
Rule, Tags, Meta,
163+
String.Name as YaraString,
164+
String.Offset as HitOffset,
165+
upload( accessor='scope',
166+
file='String.Data',
167+
name=format(format="%v-%v-%v",
168+
args=[
169+
OSPath,
170+
if(condition= String.Offset - ContextBytes &lt; 0,
171+
then= 0,
172+
else= String.Offset - ContextBytes),
173+
if(condition= String.Offset + ContextBytes &gt; Size,
174+
then= Size,
175+
else= String.Offset + ContextBytes) ]
176+
)) as HitContext
177+
FROM yara(rules=yara_rules,files=OSPath,
178+
context=ContextBytes,number=NumberOfHits)
179+
})
180+
181+
-- upload files if selected
182+
LET upload_hits = SELECT *, upload(file=OSPath,name=OSPath) as Upload FROM hits
183+
184+
-- return rows
185+
SELECT * FROM if(condition= UploadHits,
186+
then= upload_hits,
187+
else= hits )
188+
189+
column_types:
190+
- name: HitContext
191+
type: preview_upload
192+
</code></pre>
193+

0 commit comments

Comments
 (0)