Skip to content

Commit 8dbd4f6

Browse files
eirsepgoyamegh
eirsep
authored and
goyamegh
committed
fix null query filter conversion from sigma to query string query (opensearch-project#722)
* fix null query filter conversion from sigma to query string query Signed-off-by: Surya Sashank Nistala <[email protected]> * fix rule to query conversion tests for null filter Signed-off-by: Surya Sashank Nistala <[email protected]> * enhance test to verify non null doc doesnt match null query Signed-off-by: Surya Sashank Nistala <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]>
1 parent c9bb3fd commit 8dbd4f6

File tree

4 files changed

+142
-32
lines changed

4 files changed

+142
-32
lines changed

‎src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ public OSQueryBackend(String ruleCategory, boolean collectErrors, boolean enable
131131
this.reEscapeChar = "\\";
132132
this.reExpression = "%s: /%s/";
133133
this.cidrExpression = "%s: \"%s\"";
134-
this.fieldNullExpression = "%s: null";
134+
this.fieldNullExpression = "%s: (NOT [* TO *])";
135135
this.unboundValueStrExpression = "\"%s\"";
136136
this.unboundValueNumExpression = "\"%s\"";
137137
this.unboundWildcardExpression = "%s";

‎src/test/java/org/opensearch/securityanalytics/DetectorThreatIntelIT.java

Whitespace-only changes.

‎src/test/java/org/opensearch/securityanalytics/TestHelpers.java

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,38 @@ public static String randomRule() {
186186
"level: high";
187187
}
188188

189+
190+
191+
public static String randomNullRule() {
192+
return "title: null field\n" +
193+
"id: 5f92fff9-82e2-48eb-8fc1-8b133556a551\n" +
194+
"description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR\n" +
195+
"references:\n" +
196+
" - https://attack.mitre.org/tactics/TA0008/\n" +
197+
" - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942\n" +
198+
" - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-EFSR.md\n" +
199+
" - https://github.com/zeronetworks/rpcfirewall\n" +
200+
" - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/\n" +
201+
"tags:\n" +
202+
" - attack.defense_evasion\n" +
203+
"status: experimental\n" +
204+
"author: Sagie Dulce, Dekel Paz\n" +
205+
"date: 2022/01/01\n" +
206+
"modified: 2022/01/01\n" +
207+
"logsource:\n" +
208+
" product: rpc_firewall\n" +
209+
" category: application\n" +
210+
" definition: 'Requirements: install and apply the RPC Firew all to all processes with \"audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e'\n" +
211+
"detection:\n" +
212+
" selection:\n" +
213+
" EventID: 22\n" +
214+
" RecordNumber: null\n" +
215+
" condition: selection\n" +
216+
"falsepositives:\n" +
217+
" - Legitimate usage of remote file encryption\n" +
218+
"level: high";
219+
}
220+
189221
public static String randomRuleForMappingView(String field) {
190222
return "title: Remote Encrypting File System Abuse\n" +
191223
"id: 5f92fff9-82e2-48eb-8fc1-8b133556a551\n" +
@@ -1460,6 +1492,84 @@ public static String randomDocOnlyNumericAndText(int severity, int version, Stri
14601492
return String.format(Locale.ROOT, doc, severity, version, opCode);
14611493
}
14621494

1495+
//Add IPs in HostName field.
1496+
public static String randomDocWithIpIoc(int severity, int version, String ioc) {
1497+
String doc = "{\n" +
1498+
"\"EventTime\":\"2020-02-04T14:59:39.343541+00:00\",\n" +
1499+
"\"HostName\":\"%s\",\n" +
1500+
"\"Keywords\":\"9223372036854775808\",\n" +
1501+
"\"SeverityValue\":%s,\n" +
1502+
"\"Severity\":\"INFO\",\n" +
1503+
"\"EventID\":22,\n" +
1504+
"\"SourceName\":\"Microsoft-Windows-Sysmon\",\n" +
1505+
"\"ProviderGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\n" +
1506+
"\"Version\":%s,\n" +
1507+
"\"TaskValue\":22,\n" +
1508+
"\"OpcodeValue\":0,\n" +
1509+
"\"RecordNumber\":9532,\n" +
1510+
"\"ExecutionProcessID\":1996,\n" +
1511+
"\"ExecutionThreadID\":2616,\n" +
1512+
"\"Channel\":\"Microsoft-Windows-Sysmon/Operational\",\n" +
1513+
"\"Domain\":\"NT AUTHORITY\",\n" +
1514+
"\"AccountName\":\"SYSTEM\",\n" +
1515+
"\"UserID\":\"S-1-5-18\",\n" +
1516+
"\"AccountType\":\"User\",\n" +
1517+
"\"Message\":\"Dns query:\\r\\nRuleName: \\r\\nUtcTime: 2020-02-04 14:59:38.349\\r\\nProcessGuid: {b3c285a4-3cda-5dc0-0000-001077270b00}\\r\\nProcessId: 1904\\r\\nQueryName: EC2AMAZ-EPO7HKA\\r\\nQueryStatus: 0\\r\\nQueryResults: 172.31.46.38;\\r\\nImage: C:\\\\Program Files\\\\nxlog\\\\nxlog.exe\",\n" +
1518+
"\"Category\":\"Dns query (rule: DnsQuery)\",\n" +
1519+
"\"Opcode\":\"blahblah\",\n" +
1520+
"\"UtcTime\":\"2020-02-04 14:59:38.349\",\n" +
1521+
"\"ProcessGuid\":\"{b3c285a4-3cda-5dc0-0000-001077270b00}\",\n" +
1522+
"\"ProcessId\":\"1904\",\"QueryName\":\"EC2AMAZ-EPO7HKA\",\"QueryStatus\":\"0\",\n" +
1523+
"\"QueryResults\":\"172.31.46.38;\",\n" +
1524+
"\"Image\":\"C:\\\\Program Files\\\\nxlog\\\\regsvr32.exe\",\n" +
1525+
"\"EventReceivedTime\":\"2020-02-04T14:59:40.780905+00:00\",\n" +
1526+
"\"SourceModuleName\":\"in\",\n" +
1527+
"\"SourceModuleType\":\"im_msvistalog\",\n" +
1528+
"\"CommandLine\": \"eachtest\",\n" +
1529+
"\"Initiated\": \"true\"\n" +
1530+
"}";
1531+
return String.format(Locale.ROOT, doc, ioc, severity, version);
1532+
1533+
}
1534+
1535+
public static String randomDocWithNullField() {
1536+
return "{\n" +
1537+
"\"@timestamp\":\"2020-02-04T14:59:39.343541+00:00\",\n" +
1538+
"\"EventTime\":\"2020-02-04T14:59:39.343541+00:00\",\n" +
1539+
"\"HostName\":\"EC2AMAZ-EPO7HKA\",\n" +
1540+
"\"Keywords\":\"9223372036854775808\",\n" +
1541+
"\"SeverityValue\":2,\n" +
1542+
"\"Severity\":\"INFO\",\n" +
1543+
"\"EventID\":22,\n" +
1544+
"\"SourceName\":\"Microsoft-Windows-Sysmon\",\n" +
1545+
"\"ProviderGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\n" +
1546+
"\"Version\":5,\n" +
1547+
"\"TaskValue\":22,\n" +
1548+
"\"OpcodeValue\":0,\n" +
1549+
"\"RecordNumber\":null,\n" +
1550+
"\"ExecutionProcessID\":1996,\n" +
1551+
"\"ExecutionThreadID\":2616,\n" +
1552+
"\"Channel\":\"Microsoft-Windows-Sysmon/Operational\",\n" +
1553+
"\"Domain\":\"NTAUTHORITY\",\n" +
1554+
"\"AccountName\":\"SYSTEM\",\n" +
1555+
"\"UserID\":\"S-1-5-18\",\n" +
1556+
"\"AccountType\":\"User\",\n" +
1557+
"\"Message\":\"Dns query:\\r\\nRuleName: \\r\\nUtcTime: 2020-02-04 14:59:38.349\\r\\nProcessGuid: {b3c285a4-3cda-5dc0-0000-001077270b00}\\r\\nProcessId: 1904\\r\\nQueryName: EC2AMAZ-EPO7HKA\\r\\nQueryStatus: 0\\r\\nQueryResults: 172.31.46.38;\\r\\nImage: C:\\\\Program Files\\\\nxlog\\\\nxlog.exe\",\n" +
1558+
"\"Category\":\"Dns query (rule: DnsQuery)\",\n" +
1559+
"\"Opcode\":\"Info\",\n" +
1560+
"\"UtcTime\":\"2020-02-04 14:59:38.349\",\n" +
1561+
"\"ProcessGuid\":\"{b3c285a4-3cda-5dc0-0000-001077270b00}\",\n" +
1562+
"\"ProcessId\":\"1904\",\"QueryName\":\"EC2AMAZ-EPO7HKA\",\"QueryStatus\":\"0\",\n" +
1563+
"\"QueryResults\":\"172.31.46.38;\",\n" +
1564+
"\"Image\":\"C:\\\\Program Files\\\\nxlog\\\\regsvr32.exe\",\n" +
1565+
"\"EventReceivedTime\":\"2020-02-04T14:59:40.780905+00:00\",\n" +
1566+
"\"SourceModuleName\":\"in\",\n" +
1567+
"\"SourceModuleType\":\"im_msvistalog\",\n" +
1568+
"\"CommandLine\": \"eachtest\",\n" +
1569+
"\"Initiated\": \"true\"\n" +
1570+
"}";
1571+
}
1572+
14631573
public static String randomDoc() {
14641574
return "{\n" +
14651575
"\"@timestamp\":\"2020-02-04T14:59:39.343541+00:00\",\n" +

‎src/test/java/org/opensearch/securityanalytics/rules/backend/QueryBackendTests.java

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -269,20 +269,20 @@ public void testConvertValueNull() throws IOException, SigmaError {
269269
OSQueryBackend queryBackend = testBackend();
270270
List<Object> queries = queryBackend.convertRule(SigmaRule.fromYaml(
271271
" title: Test\n" +
272-
" id: 39f919f3-980b-4e6f-a975-8af7e507ef2b\n" +
273-
" status: test\n" +
274-
" level: critical\n" +
275-
" description: Detects QuarksPwDump clearing access history in hive\n" +
276-
" author: Florian Roth\n" +
277-
" date: 2017/05/15\n" +
278-
" logsource:\n" +
279-
" category: test_category\n" +
280-
" product: test_product\n" +
281-
" detection:\n" +
282-
" sel:\n" +
283-
" fieldA1: null\n" +
284-
" condition: sel", false));
285-
Assert.assertEquals("mappedA: null", queries.get(0).toString());
272+
" id: 39f919f3-980b-4e6f-a975-8af7e507ef2b\n" +
273+
" status: test\n" +
274+
" level: critical\n" +
275+
" description: Detects QuarksPwDump clearing access history in hive\n" +
276+
" author: Florian Roth\n" +
277+
" date: 2017/05/15\n" +
278+
" logsource:\n" +
279+
" category: test_category\n" +
280+
" product: test_product\n" +
281+
" detection:\n" +
282+
" sel:\n" +
283+
" fieldA1: null\n" +
284+
" condition: sel", false));
285+
Assert.assertEquals("mappedA: (NOT [* TO *])", queries.get(0).toString());
286286
}
287287

288288
public void testConvertValueRegex() throws IOException, SigmaError {
@@ -509,23 +509,23 @@ public void testConvertOrInUnallowedValueType() throws IOException, SigmaError {
509509
OSQueryBackend queryBackend = testBackend();
510510
List<Object> queries = queryBackend.convertRule(SigmaRule.fromYaml(
511511
" title: Test\n" +
512-
" id: 39f919f3-980b-4e6f-a975-8af7e507ef2b\n" +
513-
" status: test\n" +
514-
" level: critical\n" +
515-
" description: Detects QuarksPwDump clearing access history in hive\n" +
516-
" author: Florian Roth\n" +
517-
" date: 2017/05/15\n" +
518-
" logsource:\n" +
519-
" category: test_category\n" +
520-
" product: test_product\n" +
521-
" detection:\n" +
522-
" sel:\n" +
523-
" fieldA1: \n" +
524-
" - value1\n" +
525-
" - value2\n" +
526-
" - null\n" +
527-
" condition: sel", false));
528-
Assert.assertEquals("(mappedA: \"value1\") OR (mappedA: \"value2\") OR (mappedA: null)", queries.get(0).toString());
512+
" id: 39f919f3-980b-4e6f-a975-8af7e507ef2b\n" +
513+
" status: test\n" +
514+
" level: critical\n" +
515+
" description: Detects QuarksPwDump clearing access history in hive\n" +
516+
" author: Florian Roth\n" +
517+
" date: 2017/05/15\n" +
518+
" logsource:\n" +
519+
" category: test_category\n" +
520+
" product: test_product\n" +
521+
" detection:\n" +
522+
" sel:\n" +
523+
" fieldA1: \n" +
524+
" - value1\n" +
525+
" - value2\n" +
526+
" - null\n" +
527+
" condition: sel", false));
528+
Assert.assertEquals("(mappedA: \"value1\") OR (mappedA: \"value2\") OR (mappedA: (NOT [* TO *]))", queries.get(0).toString());
529529
}
530530

531531
public void testConvertOrInListNumbers() throws IOException, SigmaError {

0 commit comments

Comments
 (0)