From 7246baf0fdfcff20b50fb67947f0d116d27beaae Mon Sep 17 00:00:00 2001 From: Phoevek Date: Mon, 8 Jul 2024 22:37:22 +0300 Subject: [PATCH] =?UTF-8?q?=D0=94=D0=BE=D0=B1=D0=B0=D0=B2=D0=B8=D0=BB=20?= =?UTF-8?q?=D1=80=D0=B5=D1=88=D0=B5=D0=BD=D0=B8=D0=B5=20=D0=B4=D0=BB=D1=8F?= =?UTF-8?q?=20Task=207?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../i18n/i18n_en.yaml | 4 + .../i18n/i18n_ru.yaml | 4 + .../MacOS_Browser_cred_Access/metainfo.yaml | 22 +++++ .../MacOS_Browser_cred_Access/rule.co | 91 +++++++++++++++++++ .../tests/raw_events_1.json | 2 + .../tests/raw_events_2.json | 2 + .../tests/test_conds_1.tc | 1 + .../tests/test_conds_2.tc | 2 + 8 files changed, 128 insertions(+) create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_en.yaml create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_ru.yaml create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/metainfo.yaml create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/rule.co create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_1.json create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_2.json create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_1.tc create mode 100644 packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_2.tc diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_en.yaml b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_en.yaml new file mode 100644 index 00000000..540f82d6 --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_en.yaml @@ -0,0 +1,4 @@ +Description: 'The rule detects access to sensitive browser data by a third-party process' +EventDescriptions: + - LocalizationId: 'corrname_MacOS_Browser_cred_Access' + EventDescription: 'Process {subject.process.name} with pid {subject.process.id} has accessed browser file {object.fullpath}' diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_ru.yaml b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_ru.yaml new file mode 100644 index 00000000..de736113 --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_ru.yaml @@ -0,0 +1,4 @@ +Description: 'Правило детектирует доступ к чувствительным данным браузера сторонним процессом' +EventDescriptions: + - LocalizationId: 'corrname_MacOS_Browser_cred_Access' + EventDescription: 'Процесс {subject.process.name} с pid {subject.process.id} получил доступ к файлу браузера {object.fullpath}' diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/metainfo.yaml b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/metainfo.yaml new file mode 100644 index 00000000..ba29f23e --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/metainfo.yaml @@ -0,0 +1,22 @@ +ContentAutoName: MacOS_Browser_cred_Access +ExpertContext: + Created: 08.07.2024 + Updated: 08.07.2024 + KnowledgeHolders: + - Kirill Aparkin (Phoevek) + Usecases: + - Правило детектирует доступ к браузерным файлам сторонним процессом + Falsepositives: + - Если процесс легитимен + References: [] + Improvements: + - Вайтлистами +ObjectId: SEC-CR-203098059 +ContentRelations: + Implements: + ATTACK: + credential-access: + - T1555.003 +EventDescriptions: + - Criteria: correlation_name = "MacOS_Browser_cred_Access" + LocalizationId: corrname_MacOS_Browser_cred_Access diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/rule.co b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/rule.co new file mode 100644 index 00000000..8d50462c --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/rule.co @@ -0,0 +1,91 @@ +event Browser_Access: + key: + event_src.host, subject.process.id + filter { + filter::NotFromCorrelator() + and action == 'read' + and regex(lower(object.fullpath),"(\/users\/|~).*?(chrome|chromium|firefox|yandex|opera|safari|browser)",0 ) != null + } + +event Uncomon_Process: + key: + event_src.host, object.process.id + filter { + filter::NotFromCorrelator() + and action == 'execute' + and regex(lower(object.process.name), "chrome|chromium|firefox|yandex|opera|safari", 0) == null + } + +rule MacOS_Browser_cred_Access: Browser_Access and Uncomon_Process + + on Browser_Access { + + $object.name = object.name + $object.path = object.path + $object.fullpath = object.fullpath + + $alert.context = object.fullpath + + $subject.account.name = subject.account.name + $subject.account.session_id = subject.account.session_id + $subject.account.id = subject.account.id + } + + on Uncomon_Process { + $datafield1 = datafield1 + $datafield2 = datafield2 + $datafield3 = datafield3 + $datafield4 = datafield4 + $datafield5 = datafield5 + $datafield6 = datafield6 + $datafield7 = datafield7 + $datafield8 = datafield8 + $datafield9 = datafield9 + $datafield10 = datafield10 + + $atafield12 = datafield12 + $datafield13 = datafield13 + $datafield14 = datafield14 + $datafield15 = datafield15 + $datafield16 = datafield16 + $datafield17 = datafield17 + $datafield18 = datafield18 + + + + $subject.process.id = object.process.id + $subject.process.name = object.process.name + $subject.process.path = object.process.path + $subject.process.fullpath = object.process.fullpath + $subject.process.hash = object.process.hash + $subject.process.cmdline = object.process.cmdline + $subject.process.cwd = object.process.cwd + + + $object.process.parent.name = subject.process.name + $object.process.parent.path = subject.process.path + $object.process.parent.fullpath = subject.process.fullpath + + $alert.key = join([lower(object.process.name), lower($object.fullpath)], "|") + + } + +emit { + $correlation_type = "incident" + + $subject = "process" + $action = "access" + $object = "file_object" + $status = "success" + + $importance = "medium" + + $category.generic = "Attack" + $category.high = "Credential Access" + $category.low = "Credetial Access" + + $incident.aggregation.key = join([$correlation_name, lower($event_src.host), lower($subject.account.id)], "|") + $incident.severity = $importance + $incident.category = "Undefined" + $incident.aggregation.timeout = 2h +} \ No newline at end of file diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_1.json b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_1.json new file mode 100644 index 00000000..024acddb --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_1.json @@ -0,0 +1,2 @@ +{"body":"{\"schema_version\":1,\"mach_time\":553612764272,\"event_type\":9,\"thread\":{\"thread_id\":88925},\"version\":7,\"seq_num\":24,\"event\":{\"exec\":{\"script\":null,\"last_fd\":2,\"target\":{\"signing_id\":\"com.apple.sh\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":570492929,\"executable\":{\"path\":\"\\/bin\\/sh\",\"stat\":{\"st_blocks\":24,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":0,\"st_gid\":0,\"st_ino\":1152921500312435312,\"st_birthtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_flags\":524320,\"st_nlink\":1,\"st_mtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_ctimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_size\":134000,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2023-07-11T08:56:22.000000000Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":true,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6712,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"A09AFAD27F2DFD0CE1410259676632952B1749FB\",\"team_id\":null},\"image_cpusubtype\":-2147483646,\"image_cputype\":16777228,\"fds\":[{\"fd\":0,\"fdtype\":1},{\"fd\":1,\"pipe\":{\"pipe_id\":1840},\"fdtype\":6},{\"fd\":2,\"fdtype\":1}],\"env\":[\"TERM_SESSION_ID=w1t0p0:989C730D-8929-4EA4-90E4-043570A53A14\",\"SSH_AUTH_SOCK=\\/private\\/tmp\\/com.apple.launchd.i3wu0PDT78\\/Listeners\",\"LC_TERMINAL_VERSION=3.4.22\",\"COLORFGBG=15;0\",\"ITERM_PROFILE=Default\",\"XPC_FLAGS=0x0\",\"PWD=\\/Users\\/user\\/Desktop\",\"SHELL=\\/bin\\/zsh\",\"__CFBundleIdentifier=com.googlecode.iterm2\",\"SECURITYSESSIONID=186a4\",\"LC_CTYPE=UTF-8\",\"TERM_PROGRAM_VERSION=3.4.22\",\"TERM_PROGRAM=iTerm.app\",\"PATH=\\/opt\\/homebrew\\/bin:\\/opt\\/homebrew\\/sbin:\\/usr\\/local\\/bin:\\/System\\/Cryptexes\\/App\\/usr\\/bin:\\/usr\\/bin:\\/bin:\\/usr\\/sbin:\\/sbin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/local\\/bin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/bin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/appleinternal\\/bin\",\"LC_TERMINAL=iTerm2\",\"COLORTERM=truecolor\",\"COMMAND_MODE=unix2003\",\"TERM=xterm-256color\",\"HOME=\\/Users\\/user\",\"TMPDIR=\\/var\\/folders\\/n1\\/s1s8jdd919s8djb84sr3myrw0000gn\\/T\\/\",\"USER=user\",\"XPC_SERVICE_NAME=0\",\"LOGNAME=user\",\"LaunchInstanceID=0A2F69D4-87CF-4D66-9EF3-62CA1039F55A\",\"ITERM_SESSION_ID=w1t0p0:989C730D-8929-4EA4-90E4-043570A53A14\",\"__CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0\",\"SHLVL=1\",\"OLDPWD=\\/Users\\/user\",\"HOMEBREW_PREFIX=\\/opt\\/homebrew\",\"HOMEBREW_CELLAR=\\/opt\\/homebrew\\/Cellar\",\"HOMEBREW_REPOSITORY=\\/opt\\/homebrew\",\"MANPATH=\\/opt\\/homebrew\\/share\\/man::\",\"INFOPATH=\\/opt\\/homebrew\\/share\\/info:\",\"P9K_TTY=old\",\"_P9K_TTY=\\/dev\\/ttys001\",\"ZSH=\\/Users\\/user\\/.oh-my-zsh\",\"PAGER=less\",\"LESS=-R\",\"LSCOLORS=Gxfxcxdxbxegedabagacad\",\"LS_COLORS=di=1;36:ln=35:so=32:pi=33:ex=31:bd=34;46:cd=34;43:su=30;41:sg=30;46:tw=30;42:ow=30;43\",\"P9K_SSH=0\",\"_P9K_SSH_TTY=\\/dev\\/ttys001\",\"_=\\/Users\\/user\\/Desktop\\/.\\/mac_server_arm64\"],\"args\":[\"sh\",\"-c\",\"ditto -c -k --sequesterRsrc --keepParent \\/Users\\/user\\/1547562099 \\/Users\\/user\\/1547562099.zip --norsrc --noextattr\"],\"cwd\":{\"path\":\"\\/Users\\/user\\/Desktop\",\"stat\":{\"st_blocks\":0,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":21685,\"st_birthtimespec\":\"2023-07-11T09:26:21.000000000Z\",\"st_flags\":0,\"st_nlink\":15,\"st_mtimespec\":\"2024-03-13T12:49:17.561076436Z\",\"st_ctimespec\":\"2024-03-13T12:49:17.561076436Z\",\"st_size\":480,\"st_gen\":0,\"st_mode\":16832,\"st_atimespec\":\"2024-03-13T12:49:17.573110420Z\"},\"path_truncated\":false},\"dyld_exec_path\":\"\\/bin\\/sh\"}},\"time\":\"2024-03-13T13:20:11.569120699Z\",\"action\":{\"result\":{\"result\":{\"auth\":0},\"result_type\":0}},\"process\":{\"signing_id\":\"huy-55554944ea13e6c02eaf3a6ca71dc5742a9f368b\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":838860839,\"executable\":{\"path\":\"\\/Users\\/user\\/Desktop\\/Trading View\",\"stat\":{\"st_blocks\":1552,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":548344,\"st_birthtimespec\":\"2023-08-25T12:59:53.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2023-08-25T12:59:53.000000000Z\",\"st_ctimespec\":\"2024-03-13T12:52:44.385162893Z\",\"st_size\":790688,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2024-03-13T13:19:02.574080477Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":false,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6711,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"9820C1FD478A16B52E0EBC457AA319FCA33F5B3E\",\"team_id\":null},\"action_type\":1,\"global_seq_num\":3327}","recv_ipv4":"127.0.0.1","recv_time":"2024-07-08T15:42:30.158Z","task_id":"00000000-0000-0000-0000-000000000000","tag":"some_tag","mime":"application/json","normalized":false,"input_id":"00000000-0000-0000-0000-000000000000","type":"raw","uuid":"28eab79c-4496-484d-940f-68110ae2f1a5"} +{"body":"{\"schema_version\":1,\"mach_time\":553613251269,\"event_type\":10,\"thread\":{\"thread_id\":89233},\"version\":7,\"seq_num\":3301,\"event\":{\"open\":{\"fflag\":257,\"file\":{\"path\":\"\\/Users\\/user\\/1547562099\\/Chromium\\/Chrome\\/Password1\",\"stat\":{\"st_blocks\":80,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":554231,\"st_birthtimespec\":\"2024-03-13T13:19:06.717063974Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.717167558Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.717175975Z\",\"st_size\":40960,\"st_gen\":0,\"st_mode\":33152,\"st_atimespec\":\"2024-03-13T13:20:11.589370456Z\"},\"path_truncated\":false}}},\"time\":\"2024-03-13T13:20:11.589412456Z\",\"action\":{\"result\":{\"result\":{\"flags\":4294967295},\"result_type\":1}},\"process\":{\"signing_id\":\"com.apple.ditto\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":570509825,\"executable\":{\"path\":\"\\/usr\\/bin\\/ditto\",\"stat\":{\"st_blocks\":72,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":0,\"st_gid\":0,\"st_ino\":1152921500312435792,\"st_birthtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_flags\":524320,\"st_nlink\":1,\"st_mtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_ctimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_size\":205296,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2023-07-11T08:56:22.000000000Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":true,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6714,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"3BE1641216D62565858F47D33B6D16C7D2DC0518\",\"team_id\":null},\"action_type\":1,\"global_seq_num\":3366}","recv_ipv4":"127.0.0.1","recv_time":"2024-07-08T15:56:46.210Z","task_id":"00000000-0000-0000-0000-000000000000","tag":"some_tag","mime":"application/json","normalized":false,"input_id":"00000000-0000-0000-0000-000000000000","type":"raw","uuid":"19aa2026-3600-4101-9469-749cb0629da7"} \ No newline at end of file diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_2.json b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_2.json new file mode 100644 index 00000000..62d9aea3 --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_2.json @@ -0,0 +1,2 @@ +{"body":"{\"schema_version\":1,\"mach_time\":553612764272,\"event_type\":9,\"thread\":{\"thread_id\":88925},\"version\":7,\"seq_num\":24,\"event\":{\"exec\":{\"script\":null,\"last_fd\":2,\"target\":{\"signing_id\":\"com.apple.sh\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":570492929,\"executable\":{\"path\":\"\\/bin\\/chrome\",\"stat\":{\"st_blocks\":24,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":0,\"st_gid\":0,\"st_ino\":1152921500312435312,\"st_birthtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_flags\":524320,\"st_nlink\":1,\"st_mtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_ctimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_size\":134000,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2023-07-11T08:56:22.000000000Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":true,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6712,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"A09AFAD27F2DFD0CE1410259676632952B1749FB\",\"team_id\":null},\"image_cpusubtype\":-2147483646,\"image_cputype\":16777228,\"fds\":[{\"fd\":0,\"fdtype\":1},{\"fd\":1,\"pipe\":{\"pipe_id\":1840},\"fdtype\":6},{\"fd\":2,\"fdtype\":1}],\"env\":[\"TERM_SESSION_ID=w1t0p0:989C730D-8929-4EA4-90E4-043570A53A14\",\"SSH_AUTH_SOCK=\\/private\\/tmp\\/com.apple.launchd.i3wu0PDT78\\/Listeners\",\"LC_TERMINAL_VERSION=3.4.22\",\"COLORFGBG=15;0\",\"ITERM_PROFILE=Default\",\"XPC_FLAGS=0x0\",\"PWD=\\/Users\\/user\\/Desktop\",\"SHELL=\\/bin\\/zsh\",\"__CFBundleIdentifier=com.googlecode.iterm2\",\"SECURITYSESSIONID=186a4\",\"LC_CTYPE=UTF-8\",\"TERM_PROGRAM_VERSION=3.4.22\",\"TERM_PROGRAM=iTerm.app\",\"PATH=\\/opt\\/homebrew\\/bin:\\/opt\\/homebrew\\/sbin:\\/usr\\/local\\/bin:\\/System\\/Cryptexes\\/App\\/usr\\/bin:\\/usr\\/bin:\\/bin:\\/usr\\/sbin:\\/sbin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/local\\/bin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/bin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/appleinternal\\/bin\",\"LC_TERMINAL=iTerm2\",\"COLORTERM=truecolor\",\"COMMAND_MODE=unix2003\",\"TERM=xterm-256color\",\"HOME=\\/Users\\/user\",\"TMPDIR=\\/var\\/folders\\/n1\\/s1s8jdd919s8djb84sr3myrw0000gn\\/T\\/\",\"USER=user\",\"XPC_SERVICE_NAME=0\",\"LOGNAME=user\",\"LaunchInstanceID=0A2F69D4-87CF-4D66-9EF3-62CA1039F55A\",\"ITERM_SESSION_ID=w1t0p0:989C730D-8929-4EA4-90E4-043570A53A14\",\"__CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0\",\"SHLVL=1\",\"OLDPWD=\\/Users\\/user\",\"HOMEBREW_PREFIX=\\/opt\\/homebrew\",\"HOMEBREW_CELLAR=\\/opt\\/homebrew\\/Cellar\",\"HOMEBREW_REPOSITORY=\\/opt\\/homebrew\",\"MANPATH=\\/opt\\/homebrew\\/share\\/man::\",\"INFOPATH=\\/opt\\/homebrew\\/share\\/info:\",\"P9K_TTY=old\",\"_P9K_TTY=\\/dev\\/ttys001\",\"ZSH=\\/Users\\/user\\/.oh-my-zsh\",\"PAGER=less\",\"LESS=-R\",\"LSCOLORS=Gxfxcxdxbxegedabagacad\",\"LS_COLORS=di=1;36:ln=35:so=32:pi=33:ex=31:bd=34;46:cd=34;43:su=30;41:sg=30;46:tw=30;42:ow=30;43\",\"P9K_SSH=0\",\"_P9K_SSH_TTY=\\/dev\\/ttys001\",\"_=\\/Users\\/user\\/Desktop\\/.\\/mac_server_arm64\"],\"args\":[\"chrome\",\"-c\",\"ditto -c -k --sequesterRsrc --keepParent \\/Users\\/user\\/1547562099 \\/Users\\/user\\/1547562099.zip --norsrc --noextattr\"],\"cwd\":{\"path\":\"\\/Users\\/user\\/Desktop\",\"stat\":{\"st_blocks\":0,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":21685,\"st_birthtimespec\":\"2023-07-11T09:26:21.000000000Z\",\"st_flags\":0,\"st_nlink\":15,\"st_mtimespec\":\"2024-03-13T12:49:17.561076436Z\",\"st_ctimespec\":\"2024-03-13T12:49:17.561076436Z\",\"st_size\":480,\"st_gen\":0,\"st_mode\":16832,\"st_atimespec\":\"2024-03-13T12:49:17.573110420Z\"},\"path_truncated\":false},\"dyld_exec_path\":\"\\/bin\\/chrome\"}},\"time\":\"2024-03-13T13:20:11.569120699Z\",\"action\":{\"result\":{\"result\":{\"auth\":0},\"result_type\":0}},\"process\":{\"signing_id\":\"huy-55554944ea13e6c02eaf3a6ca71dc5742a9f368b\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":838860839,\"executable\":{\"path\":\"\\/Users\\/user\\/Desktop\\/Trading View\",\"stat\":{\"st_blocks\":1552,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":548344,\"st_birthtimespec\":\"2023-08-25T12:59:53.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2023-08-25T12:59:53.000000000Z\",\"st_ctimespec\":\"2024-03-13T12:52:44.385162893Z\",\"st_size\":790688,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2024-03-13T13:19:02.574080477Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":false,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6711,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"9820C1FD478A16B52E0EBC457AA319FCA33F5B3E\",\"team_id\":null},\"action_type\":1,\"global_seq_num\":3327}","recv_ipv4":"127.0.0.1","recv_time":"2024-07-08T15:42:30.158Z","task_id":"00000000-0000-0000-0000-000000000000","tag":"some_tag","mime":"application/json","normalized":false,"input_id":"00000000-0000-0000-0000-000000000000","type":"raw","uuid":"28eab79c-4496-484d-940f-68110ae2f1a5"} +{"body":"{\"schema_version\":1,\"mach_time\":553613251269,\"event_type\":10,\"thread\":{\"thread_id\":89233},\"version\":7,\"seq_num\":3301,\"event\":{\"open\":{\"fflag\":257,\"file\":{\"path\":\"\\/Users\\/user\\/1547562099\\/Chromium\\/Chrome\\/Password1\",\"stat\":{\"st_blocks\":80,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":554231,\"st_birthtimespec\":\"2024-03-13T13:19:06.717063974Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.717167558Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.717175975Z\",\"st_size\":40960,\"st_gen\":0,\"st_mode\":33152,\"st_atimespec\":\"2024-03-13T13:20:11.589370456Z\"},\"path_truncated\":false}}},\"time\":\"2024-03-13T13:20:11.589412456Z\",\"action\":{\"result\":{\"result\":{\"flags\":4294967295},\"result_type\":1}},\"process\":{\"signing_id\":\"com.apple.ditto\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":570509825,\"executable\":{\"path\":\"\\/usr\\/bin\\/ditto\",\"stat\":{\"st_blocks\":72,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":0,\"st_gid\":0,\"st_ino\":1152921500312435792,\"st_birthtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_flags\":524320,\"st_nlink\":1,\"st_mtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_ctimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_size\":205296,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2023-07-11T08:56:22.000000000Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":true,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6714,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"3BE1641216D62565858F47D33B6D16C7D2DC0518\",\"team_id\":null},\"action_type\":1,\"global_seq_num\":3366}","recv_ipv4":"127.0.0.1","recv_time":"2024-07-08T15:56:46.210Z","task_id":"00000000-0000-0000-0000-000000000000","tag":"some_tag","mime":"application/json","normalized":false,"input_id":"00000000-0000-0000-0000-000000000000","type":"raw","uuid":"19aa2026-3600-4101-9469-749cb0629da7"} \ No newline at end of file diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_1.tc b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_1.tc new file mode 100644 index 00000000..99f7bb3c --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_1.tc @@ -0,0 +1 @@ +expect 1 {"correlation_name":"MacOS_Browser_cred_Access"} \ No newline at end of file diff --git a/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_2.tc b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_2.tc new file mode 100644 index 00000000..45bfe7c9 --- /dev/null +++ b/packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/test_conds_2.tc @@ -0,0 +1,2 @@ +# nothing test +expect not {"correlation_name":"MacOS_Browser_cred_Access"} \ No newline at end of file