Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Linux/Auditd support #5

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+76 −20
Open

Linux/Auditd support #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3534f3d
up
buixor Dec 18, 2024
f3a2761
up
buixor Dec 18, 2024
ea30467
lint
buixor Dec 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions sigma/backends/crowdsec/crowdsec.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
"""Crowdsec backend for Sigma rules."""
# pylint: disable=line-too-long

import sys
from typing import Pattern, Union, ClassVar, Tuple, List, Dict, Any
import warnings
import re
Expand Down Expand Up @@ -221,7 +221,7 @@ def finalize_query_default(self,
meta = self.generate_labels(rule, 0, "http:exploit", "true")
#here scope is implicit : ip
### WINDOWS REGISTRY ADD
if rule.logsource.category == "registry_add" and rule.logsource.product == "windows":
elif rule.logsource.category == "registry_add" and rule.logsource.product == "windows":
meta = self.generate_labels(rule, 0, "windows:audit", "false")
prefilter = "(evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '12')"
blackhole = "blackhole: 2m"
Expand All @@ -230,14 +230,27 @@ def finalize_query_default(self,
expression: evt.Parsed.ParentProcessId
"""
### WINDOWS PROCESS CREATION
if rule.logsource.category == "process_creation" and rule.logsource.product == "windows":
elif rule.logsource.category == "process_creation" and rule.logsource.product == "windows":
meta = self.generate_labels(rule, 0, "windows:audit", "false")
prefilter = "(evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1')"
blackhole = "blackhole: 2m"
scope = """scope:
type: ParentProcessId
expression: evt.Parsed.ParentProcessId
"""
### LINUX PROCESS CREATION
elif rule.logsource.service == "auditd" and rule.logsource.product == "linux":
meta = self.generate_labels(rule, 0, "linux:audit", "false")
prefilter = "(evt.Parsed.program == 'auditd')"
blackhole = "blackhole: 2m"
scope = """scope:
type: pid
expression: evt.Meta.ppid
"""
else:
warnings.warn("Unknown rule type, aborting")
sys.exit(1)

if rule.description:
formatted_desc = rule.description.replace("\n", " ")
else:
Expand Down
77 changes: 60 additions & 17 deletions sigma/pipelines/crowdsec/crowdsec.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,15 +44,9 @@ def crowdsec_pipeline() -> ProcessingPipeline: # Processing pipelines sho
ProcessingItem( # This is an example for processing items generated from the mapping above.
identifier="crowdsec_windows_process_creation_fieldmapping",
rule_conditions=[LogsourceCondition(category="process_creation",product="windows",)],
transformation=FieldMappingTransformation({
"Computer" : "evt.Parsed.Computer",
})
),
ProcessingItem( # This is an example for processing items generated from the mapping above.
identifier="crowdsec_windows_registry_add_fieldmapping",
rule_conditions=[LogsourceCondition(category="process_creation",product="windows",)],
transformation=FieldMappingTransformation({
#"EventID": "int(evt.Parsed.EventID)",
"Computer" : "evt.Parsed.Computer",
"Company": "evt.Parsed.Company",
"OriginalFileName" : "evt.Parsed.OriginalFileName",
"UtcTime": "evt.StrTime",
Expand Down Expand Up @@ -92,15 +86,64 @@ def crowdsec_pipeline() -> ProcessingPipeline: # Processing pipelines sho
"c-uri": "evt.Parsed.uri",
})
),
# ProcessingItem(
# identifier="crowdsec_rule_not_supported",
# rule_condition_linking=any,
# transformation=RuleFailureTransformation("Rule type not yet supported by crowdsec backend!"),
# rule_condition_negation=True,
# rule_conditions=[
# RuleProcessingItemAppliedCondition("crowdsec_webserver_fieldmapping"),
# RuleProcessingItemAppliedCondition("crowdsec_windows_fieldmapping")
# ],
# ),
ProcessingItem( # This is an example for processing items generated from the mapping above.
#fields:
# a1-a7
# PATH (?)


identifier="crowdsec_linux_execve_fieldmapping",
rule_conditions=[LogsourceCondition(service="auditd",product="linux",)],
transformation=FieldMappingTransformation({
# generic auditd fields
"auid": "evt.Meta.auid",
"comm": "evt.Meta.comm",
"euid": "evt.Meta.euid",
"exe": "evt.Meta.exe",
"GID" : "evt.Meta.str_GID",
"gid": "evt.Meta.gid",
"pid": "evt.Meta.pid",
"ppid": "evt.Meta.ppid",
"res": "evt.Meta.res",
"ses": "evt.Meta.ses",
"sig": "evt.Meta.sig",
"subj": "evt.Meta.subj",
"tty": "evt.Meta.tty",
"type": "evt.Meta.auditd_type",
"UID" : "evt.Meta.str_UID",
"uid": "evt.Meta.uid",
#EXECVE related fields
"a1": "evt.Parsed.a1",
"a2": "evt.Parsed.a2",
"a3": "evt.Parsed.a3",
"a4": "evt.Parsed.a4",
"a5": "evt.Parsed.a5",
"a6": "evt.Parsed.a6",
"a7": "evt.Parsed.a7",
"a8": "evt.Parsed.a8",
"a9": "evt.Parsed.a9",
"a10": "evt.Parsed.a10",
#PATH related fields
"cap_fe": "evt.Meta.cap_fe",
"cap_fi": "evt.Meta.cap_fi",
"cap_fp": "evt.Meta.cap_fp",
"cap_frootid": "evt.Meta.cap_frootid",
"cap_fver": "evt.Meta.cap_fver",
"dev": "evt.Meta.dev",
"inode": "evt.Meta.inode",
"item": "evt.Meta.item",
"mode": "evt.Meta.mode",
"name": "evt.Meta.name",
"nametype": "evt.Meta.nametype",
"obj": "evt.Meta.obj",
"objtype": "evt.Meta.objtype",
"ogid": "evt.Meta.ogid",
"ouid": "evt.Meta.ouid",
"rdev": "evt.Meta.rdev",
#SERVICE_STOP related fields
#N/A

})
),
],
)
Loading