[Security Solution] [Timeline] Endpoint row renderers (2nd batch) #91446
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR implements the 2nd batch of Endpoint row renderers, **including the new Ransomware alerts**, by adding new row renderers for the following Endpoint alerts and events: | event.dataset | event.type | event.category | event.action | |--------------------------|------------|----------------|-----------------| | endpoint.alerts | denied | file | creation | | endpoint.alerts | allowed | file | creation | | endpoint.alerts | denied | file | files-encrypted | | endpoint.alerts | allowed | file | files-encrypted | | endpoint.alerts | denied | file | modification | | endpoint.alerts | allowed | file | modification | | endpoint.alerts | denied | file | rename | | endpoint.alerts | allowed | file | rename | | endpoint.alerts | denied | process | execution | | endpoint.alerts | allowed | process | execution | | endpoint.events.file | change | file | modification | | endpoint.events.file | change | file | overwrite | | endpoint.events.file | change | file | rename | | endpoint.events.registry | change | registry | modification | | endpoint.events.library | start | library | load | | endpoint.events.network | protocol | network | http_request | | endpoint.events.process | start | process | exec | | endpoint.events.process | start | process | fork | Other updates: - All row renders will now only display the `file.hash.sha256` and `process.hash.sha256`. (The `sha1` and `md5` hashes will no longer be displayed) ## Malware File Creation Prevented alert Malware File Creation Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: creation ``` ### Sample Malware File Creation Prevented alert  `win2019-endpoint-1` was prevented from creating a malicious file `6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmp` in `C:\Users\sean\Downloads\6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmp` via `chrome.exe` (`8944`) `C:\Program Files\Google\Chrome\Application\chrome.exe` via parent process `explorer.exe` (`1008`) with result `success` `7cc42618e580f233fee47e82312cc5c3476cb5de9219ba3f9eb7f99ac0659c30` ### Fields in a Malware File Creation Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from creating a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Creation Detected alert Malware File Creation Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: creation ``` ### Sample Malware File Creation Detected alert  `DESKTOP-1` was detected creating a malicious file `mimikatz_write.exe` in `C:\temp\mimikatz_write.exe` via `python.exe` (`4400`) `C:\Python27\python.exe` `main.py` `-a` `execute` `-p` `c:\temp` via parent process `pythonservice.exe` (`2936`) with result `success` `263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0` ### Fields in a Malware File Creation Detected alert `user.name` \ `user.domain` @ `host.name` was detected creating a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Ransomware Files Encrypted Prevented alert Ransomware Files Encrypted Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: files-encrypted ``` ### Sample Ransomware Files Encrypted Prevented alert  `DESKTOP-1` ransomware was prevented from encrypting files via `powershell.exe` (`6056`) `powershell.exe` `-file` `mock_ransomware_v3.ps1` via parent process `cmd.exe` (`10680`) with result `success` `e9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7` ### Fields in a Ransomware Files Encrypted Prevented alert `user.name` \ `user.domain` @ `host.name` ransomware was prevented from encrypting files via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Ransomware Files Encrypted Detected alert Ransomware Files Encrypted Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: files-encrypted ``` ### Sample Ransomware Files Encrypted Detected alert  `DESKTOP-1` ransomware was detected encrypting files via `powershell.exe` (`4684`) `powershell.exe` `-file` `mock_ransomware_v3.ps1` via parent process `cmd.exe` (`8616`) with result `success` `e9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7` ### Fields in a Ransomware Files Encrypted Detected alert `user.name` \ `user.domain` @ `host.name` ransomware was detected encrypting files via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Malware File Modification Prevented alert Malware File Modification Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: modification ``` ### Sample Malware File Modification Prevented alert  `win2019-endpoint-1` was prevented from modifying a malicious file `mimikatz - Copy.exe` in `C:\Users\sean\Downloads\mimikatz_trunk (1)\x64\mimikatz - Copy.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc` ### Fields in a Malware File Modification Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from modifying a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Modification Detected alert Malware File Modification Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: modification ``` ### Sample Malware File Modification Detected alert  `mac-1.local` was detected modifying a malicious file `aircrack` in `/private/var/root/write_malware/modules/write_malware/aircrack` via `Python` (`5995`) `/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python` `main.py` `-a` `modify` via parent process `Python` (`97`) with result `success` `f0954d9673878b2223b00b7ec770c7b438d876a9bb44ec78457e5c618f31f52b` ### Fields in a Malware File Modification Detected alert `user.name` \ `user.domain` @ `host.name` was detected modifying a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Rename Prevented alert Malware File Rename Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: rename ``` ### Sample Malware File Rename Prevented alert  `win2019-endpoint-1` was prevented from renaming a malicious file `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` in `C:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97` ### Fields in a Malware File Rename Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from renaming a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Rename Detected alert Malware File Rename Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: rename ``` ### Sample Malware File Rename Detected alert  `win2019-endpoint-1` was detected renaming a malicious file `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` in `C:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97` ### Fields in a Malware File Rename Detected alert `user.name` \ `user.domain` @ `host.name` was detected renaming a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware Process Execution Prevented alert Malware Process Execution Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: process and event.action: execution ``` ### Sample Malware Process Execution Prevented alert  `win2019-endpoint-1` was prevented from executing a malicious process `C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe` (`6920`) `C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe` via parent process `explorer.exe` (`1008`) with result `success` `3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb` ### Fields in a Sample Malware Process Execution Prevented alert `host.name` was prevented from executing a malicious process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Malware Process Execution Detected alert Malware Process Execution Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: process and event.action: execution ``` ### Sample Malware Process Execution Detected alert  `DESKTOP-1` was detected executing a malicious process `mimikatz_write.exe` (`8668`) `c:\temp\mimikatz_write.exe` via parent process `python.exe` (`4400`) with result `success` `263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0` ### Fields in a Sample Malware Process Execution Detected alert `host.name` was detected executing a malicious process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## File (FIM) Modification events Endpoint File (FIM) Modification events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: modification ``` ### Sample rendered File (FIM) Modification event Each field with `this formatting` is draggable (to pivot a search) in the row-rendered event:  `admin` @ `test-Mac.local` modified a file `.dat.nosync01a5.6hoWv1` in `/Users/admin/Library/Application Support/CrashReporter/.dat.nosync01a5.6hoWv1` via `diagnostics_agent` `(421)` ### Fields in a File (FIM) Modification event `user.name` \ `user.domain` @ `host.name` modified a file `file.name` in `file.path` via `process.name` `(process.pid)` ## File (FIM) Overwrite events Endpoint File (FIM) Overwrite events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: overwrite ``` ### Sample rendered File (FIM) Overwrite event  `LOCAL SERVICE` \ `NT AUTHORITY` @ `windows-endpoint-1` overwrote a file `lastalive0.dat` in `C:\Windows\ServiceState\EventLog\Data\lastalive0.dat` via `svchost.exe` `(1228)` ### Fields in a File (FIM) Overwrite event `user.name` \ `user.domain` @ `host.name` overwrote a file `file.name` in `file.path` via `process.name` `(process.pid)` ## File (FIM) Rename events Endpoint File (FIM) Rename events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: rename ``` ### Sample rendered File (FIM) Rename event  `LOCAL SERVICE` \ `NT AUTHORITY` @ `windows-endpoint-1` renamed a file `SRU.log` in `C:\Windows\System32\sru\SRU.log` from its original path `C:\Windows\System32\sru\SRUtmp.log` via `svchost.exe` `(1204)` ### Fields in a File (FIM) Rename event `user.name` \ `user.domain` @ `host.name` renamed a file `file.name` in `file.path` from its original path `file.Ext.original.path` via `process.name` `(process.pid)` ## Registry Modification events Registry Modification events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.registry and event.action: modification ``` ### Sample Registry Modification event  `SYSTEM` \ `NT AUTHORITY` @ `win2019-endpoint-1` modified registry key `SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState` with new value `HKLM\SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue` via `GoogleUpdate.exe` `(7408)` ### Fields in a Registry Modification event `user.name` \ `user.domain` @ `host.name` modified registry key `registry.key` with new value `registry.path` via `process.name` `(process.pid)` ## Library Load events Library Load events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.library and event.action: load ``` ### Sample Library Load event  `SYSTEM` \ `NT AUTHORITY` @ `win2019-endpoint-1` loaded library `bcrypt.dll` in `C:\Windows\System32\bcrypt.dll` via `sshd.exe` `(9644)` `e70f5d8f87aab14e3160227d38387889befbe37fa4f8f5adc59eff52804b35fd` `2c4ba5c1482987d50a182bad915f52cd6611ee63` `00439016776de367bad087d739a03797` ### Fields in a Library Load event `user.name` \ `user.domain` @ `host.name` loaded library `file.name` in `file.path` via `process.name` `(process.pid)` `file.hash.sha256` `file.hash.sha1` `file.hash.md5` ## HTTP Request events HTTP Request events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.network and event.action: http_request ``` ### Sample HTTP Request event  Network HTTP Request events, like the one in the screenshot above, are also rendered by the Netflow row renderer, which displays information that includes the directionality of the connection, protocol, and source / destination details. `NETWORK SERVICE` \ `NT AUTHORITY` @ `win2019-endpoint-1` made a http request via `svchost.exe` `(2232)` ### Fields in a HTTP Request event `user.name` \ `user.domain` @ `host.name` made a http request via `process.name` `(process.pid)` ## Process Exec events Endpoint Process Exec events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.process and event.action: exec ``` ### Sample rendered Process Exec event  `admin` @ `test-mac.local` executed process `mdworker_shared` (`4454`) `/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared` `-s` `mdworker` `-c` `MDSImporterWorker` `-m` `com.apple.mdworker.shared` via parent process `launchd` (`1`) `4bc018ac461706496302d1faab0a8bb39aad974eb432758665103165f3a2dd2b` ### Fields in a Process Exec event The following fields will be used to render a Process Exec event: `user.name` @ `host.name` executed process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) `process.hash.sha256` ## Process Fork events Endpoint Process Fork events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.process and event.action: fork ``` ### Sample rendered Process Fork event  `admin` @ `test-mac.local` forked process `zoom.us` (`4042`) `/Applications/zoom.us.app/Contents/MacOS/zoom.us` via parent process `zoom.us` (`3961`) `cbf3d059cc9f9c0adff5ef15bf331b95ab381837fa0adecd965a41b5846f4bd4` ### Fields in a Process Fork event The following fields will be used to render a Process Exec event: `user.name` @ `host.name` forked process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) `process.hash.sha256`
andrew-goldstein
added
release_note:enhancement
v8.0.0
v7.12.0
Team:Threat Hunting
|
Pinging @elastic/security-threat-hunting (Team:Threat Hunting) |
|
@elasticmachine merge upstream |
XavierM
reviewed
Feb 16, 2021
.../plugins/security_solution/public/timelines/components/timeline/body/renderers/file_hash.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Feb 16, 2021
...ugins/security_solution/public/timelines/components/timeline/body/renderers/process_hash.tsx
Outdated
Show resolved
Hide resolved
XavierM
approved these changes
Feb 16, 2021
…renderers_batch_2_v2
andrew-goldstein
force-pushed
the
endpoint_row_renderers_batch_2_v2
branch
from
d6bee7f to
62fd1e6
Compare
💚 Build SucceededMetrics [docs]Module Count
Async chunks
History
To update your PR or re-run it, just comment with: |
andrew-goldstein
added a commit
to andrew-goldstein/kibana
that referenced
this pull request
Feb 17, 2021
…astic#91446) ## [Security Solution] [Timeline] Endpoint row renderers (2nd batch) This PR implements the 2nd batch of Endpoint row renderers, **including the new Ransomware alerts**, by adding new row renderers for the following Endpoint alerts and events: | event.dataset | event.type | event.category | event.action | |--------------------------|------------|----------------|-----------------| | endpoint.alerts | denied | file | creation | | endpoint.alerts | allowed | file | creation | | endpoint.alerts | denied | file | files-encrypted | | endpoint.alerts | allowed | file | files-encrypted | | endpoint.alerts | denied | file | modification | | endpoint.alerts | allowed | file | modification | | endpoint.alerts | denied | file | rename | | endpoint.alerts | allowed | file | rename | | endpoint.alerts | denied | process | execution | | endpoint.alerts | allowed | process | execution | | endpoint.events.file | change | file | modification | | endpoint.events.file | change | file | overwrite | | endpoint.events.file | change | file | rename | | endpoint.events.registry | change | registry | modification | | endpoint.events.library | start | library | load | | endpoint.events.network | protocol | network | http_request | | endpoint.events.process | start | process | exec | | endpoint.events.process | start | process | fork | Other updates: - All row renders will now only display the `file.hash.sha256` and `process.hash.sha256`. (The `sha1` and `md5` hashes will no longer be displayed) ## Malware File Creation Prevented alert Malware File Creation Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: creation ``` ### Sample Malware File Creation Prevented alert  `win2019-endpoint-1` was prevented from creating a malicious file `6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmp` in `C:\Users\sean\Downloads\6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmp` via `chrome.exe` (`8944`) `C:\Program Files\Google\Chrome\Application\chrome.exe` via parent process `explorer.exe` (`1008`) with result `success` `7cc42618e580f233fee47e82312cc5c3476cb5de9219ba3f9eb7f99ac0659c30` ### Fields in a Malware File Creation Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from creating a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Creation Detected alert Malware File Creation Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: creation ``` ### Sample Malware File Creation Detected alert  `DESKTOP-1` was detected creating a malicious file `mimikatz_write.exe` in `C:\temp\mimikatz_write.exe` via `python.exe` (`4400`) `C:\Python27\python.exe` `main.py` `-a` `execute` `-p` `c:\temp` via parent process `pythonservice.exe` (`2936`) with result `success` `263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0` ### Fields in a Malware File Creation Detected alert `user.name` \ `user.domain` @ `host.name` was detected creating a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Ransomware Files Encrypted Prevented alert Ransomware Files Encrypted Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: files-encrypted ``` ### Sample Ransomware Files Encrypted Prevented alert  `DESKTOP-1` ransomware was prevented from encrypting files via `powershell.exe` (`6056`) `powershell.exe` `-file` `mock_ransomware_v3.ps1` via parent process `cmd.exe` (`10680`) with result `success` `e9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7` ### Fields in a Ransomware Files Encrypted Prevented alert `user.name` \ `user.domain` @ `host.name` ransomware was prevented from encrypting files via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Ransomware Files Encrypted Detected alert Ransomware Files Encrypted Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: files-encrypted ``` ### Sample Ransomware Files Encrypted Detected alert  `DESKTOP-1` ransomware was detected encrypting files via `powershell.exe` (`4684`) `powershell.exe` `-file` `mock_ransomware_v3.ps1` via parent process `cmd.exe` (`8616`) with result `success` `e9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7` ### Fields in a Ransomware Files Encrypted Detected alert `user.name` \ `user.domain` @ `host.name` ransomware was detected encrypting files via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Malware File Modification Prevented alert Malware File Modification Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: modification ``` ### Sample Malware File Modification Prevented alert  `win2019-endpoint-1` was prevented from modifying a malicious file `mimikatz - Copy.exe` in `C:\Users\sean\Downloads\mimikatz_trunk (1)\x64\mimikatz - Copy.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc` ### Fields in a Malware File Modification Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from modifying a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Modification Detected alert Malware File Modification Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: modification ``` ### Sample Malware File Modification Detected alert  `mac-1.local` was detected modifying a malicious file `aircrack` in `/private/var/root/write_malware/modules/write_malware/aircrack` via `Python` (`5995`) `/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python` `main.py` `-a` `modify` via parent process `Python` (`97`) with result `success` `f0954d9673878b2223b00b7ec770c7b438d876a9bb44ec78457e5c618f31f52b` ### Fields in a Malware File Modification Detected alert `user.name` \ `user.domain` @ `host.name` was detected modifying a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Rename Prevented alert Malware File Rename Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: rename ``` ### Sample Malware File Rename Prevented alert  `win2019-endpoint-1` was prevented from renaming a malicious file `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` in `C:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97` ### Fields in a Malware File Rename Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from renaming a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Rename Detected alert Malware File Rename Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: rename ``` ### Sample Malware File Rename Detected alert  `win2019-endpoint-1` was detected renaming a malicious file `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` in `C:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97` ### Fields in a Malware File Rename Detected alert `user.name` \ `user.domain` @ `host.name` was detected renaming a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware Process Execution Prevented alert Malware Process Execution Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: process and event.action: execution ``` ### Sample Malware Process Execution Prevented alert  `win2019-endpoint-1` was prevented from executing a malicious process `C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe` (`6920`) `C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe` via parent process `explorer.exe` (`1008`) with result `success` `3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb` ### Fields in a Sample Malware Process Execution Prevented alert `host.name` was prevented from executing a malicious process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Malware Process Execution Detected alert Malware Process Execution Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: process and event.action: execution ``` ### Sample Malware Process Execution Detected alert  `DESKTOP-1` was detected executing a malicious process `mimikatz_write.exe` (`8668`) `c:\temp\mimikatz_write.exe` via parent process `python.exe` (`4400`) with result `success` `263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0` ### Fields in a Sample Malware Process Execution Detected alert `host.name` was detected executing a malicious process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## File (FIM) Modification events Endpoint File (FIM) Modification events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: modification ``` ### Sample rendered File (FIM) Modification event Each field with `this formatting` is draggable (to pivot a search) in the row-rendered event:  `admin` @ `test-Mac.local` modified a file `.dat.nosync01a5.6hoWv1` in `/Users/admin/Library/Application Support/CrashReporter/.dat.nosync01a5.6hoWv1` via `diagnostics_agent` `(421)` ### Fields in a File (FIM) Modification event `user.name` \ `user.domain` @ `host.name` modified a file `file.name` in `file.path` via `process.name` `(process.pid)` ## File (FIM) Overwrite events Endpoint File (FIM) Overwrite events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: overwrite ``` ### Sample rendered File (FIM) Overwrite event  `LOCAL SERVICE` \ `NT AUTHORITY` @ `windows-endpoint-1` overwrote a file `lastalive0.dat` in `C:\Windows\ServiceState\EventLog\Data\lastalive0.dat` via `svchost.exe` `(1228)` ### Fields in a File (FIM) Overwrite event `user.name` \ `user.domain` @ `host.name` overwrote a file `file.name` in `file.path` via `process.name` `(process.pid)` ## File (FIM) Rename events Endpoint File (FIM) Rename events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: rename ``` ### Sample rendered File (FIM) Rename event  `LOCAL SERVICE` \ `NT AUTHORITY` @ `windows-endpoint-1` renamed a file `SRU.log` in `C:\Windows\System32\sru\SRU.log` from its original path `C:\Windows\System32\sru\SRUtmp.log` via `svchost.exe` `(1204)` ### Fields in a File (FIM) Rename event `user.name` \ `user.domain` @ `host.name` renamed a file `file.name` in `file.path` from its original path `file.Ext.original.path` via `process.name` `(process.pid)` ## Registry Modification events Registry Modification events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.registry and event.action: modification ``` ### Sample Registry Modification event  `SYSTEM` \ `NT AUTHORITY` @ `win2019-endpoint-1` modified registry key `SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState` with new value `HKLM\SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue` via `GoogleUpdate.exe` `(7408)` ### Fields in a Registry Modification event `user.name` \ `user.domain` @ `host.name` modified registry key `registry.key` with new value `registry.path` via `process.name` `(process.pid)` ## Library Load events Library Load events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.library and event.action: load ``` ### Sample Library Load event  `SYSTEM` \ `NT AUTHORITY` @ `win2019-endpoint-1` loaded library `bcrypt.dll` in `C:\Windows\System32\bcrypt.dll` via `sshd.exe` `(9644)` `e70f5d8f87aab14e3160227d38387889befbe37fa4f8f5adc59eff52804b35fd` `2c4ba5c1482987d50a182bad915f52cd6611ee63` `00439016776de367bad087d739a03797` ### Fields in a Library Load event `user.name` \ `user.domain` @ `host.name` loaded library `file.name` in `file.path` via `process.name` `(process.pid)` `file.hash.sha256` `file.hash.sha1` `file.hash.md5` ## HTTP Request events HTTP Request events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.network and event.action: http_request ``` ### Sample HTTP Request event  Network HTTP Request events, like the one in the screenshot above, are also rendered by the Netflow row renderer, which displays information that includes the directionality of the connection, protocol, and source / destination details. `NETWORK SERVICE` \ `NT AUTHORITY` @ `win2019-endpoint-1` made a http request via `svchost.exe` `(2232)` ### Fields in a HTTP Request event `user.name` \ `user.domain` @ `host.name` made a http request via `process.name` `(process.pid)` ## Process Exec events Endpoint Process Exec events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.process and event.action: exec ``` ### Sample rendered Process Exec event  `admin` @ `test-mac.local` executed process `mdworker_shared` (`4454`) `/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared` `-s` `mdworker` `-c` `MDSImporterWorker` `-m` `com.apple.mdworker.shared` via parent process `launchd` (`1`) `4bc018ac461706496302d1faab0a8bb39aad974eb432758665103165f3a2dd2b` ### Fields in a Process Exec event The following fields will be used to render a Process Exec event: `user.name` @ `host.name` executed process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) `process.hash.sha256` ## Process Fork events Endpoint Process Fork events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.process and event.action: fork ``` ### Sample rendered Process Fork event  `admin` @ `test-mac.local` forked process `zoom.us` (`4042`) `/Applications/zoom.us.app/Contents/MacOS/zoom.us` via parent process `zoom.us` (`3961`) `cbf3d059cc9f9c0adff5ef15bf331b95ab381837fa0adecd965a41b5846f4bd4` ### Fields in a Process Fork event The following fields will be used to render a Process Exec event: `user.name` @ `host.name` forked process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) `process.hash.sha256`
andrew-goldstein
added a commit
that referenced
this pull request
Feb 17, 2021
…1446) (#91601) ## [Security Solution] [Timeline] Endpoint row renderers (2nd batch) This PR implements the 2nd batch of Endpoint row renderers, **including the new Ransomware alerts**, by adding new row renderers for the following Endpoint alerts and events: | event.dataset | event.type | event.category | event.action | |--------------------------|------------|----------------|-----------------| | endpoint.alerts | denied | file | creation | | endpoint.alerts | allowed | file | creation | | endpoint.alerts | denied | file | files-encrypted | | endpoint.alerts | allowed | file | files-encrypted | | endpoint.alerts | denied | file | modification | | endpoint.alerts | allowed | file | modification | | endpoint.alerts | denied | file | rename | | endpoint.alerts | allowed | file | rename | | endpoint.alerts | denied | process | execution | | endpoint.alerts | allowed | process | execution | | endpoint.events.file | change | file | modification | | endpoint.events.file | change | file | overwrite | | endpoint.events.file | change | file | rename | | endpoint.events.registry | change | registry | modification | | endpoint.events.library | start | library | load | | endpoint.events.network | protocol | network | http_request | | endpoint.events.process | start | process | exec | | endpoint.events.process | start | process | fork | Other updates: - All row renders will now only display the `file.hash.sha256` and `process.hash.sha256`. (The `sha1` and `md5` hashes will no longer be displayed) ## Malware File Creation Prevented alert Malware File Creation Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: creation ``` ### Sample Malware File Creation Prevented alert  `win2019-endpoint-1` was prevented from creating a malicious file `6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmp` in `C:\Users\sean\Downloads\6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmp` via `chrome.exe` (`8944`) `C:\Program Files\Google\Chrome\Application\chrome.exe` via parent process `explorer.exe` (`1008`) with result `success` `7cc42618e580f233fee47e82312cc5c3476cb5de9219ba3f9eb7f99ac0659c30` ### Fields in a Malware File Creation Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from creating a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Creation Detected alert Malware File Creation Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: creation ``` ### Sample Malware File Creation Detected alert  `DESKTOP-1` was detected creating a malicious file `mimikatz_write.exe` in `C:\temp\mimikatz_write.exe` via `python.exe` (`4400`) `C:\Python27\python.exe` `main.py` `-a` `execute` `-p` `c:\temp` via parent process `pythonservice.exe` (`2936`) with result `success` `263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0` ### Fields in a Malware File Creation Detected alert `user.name` \ `user.domain` @ `host.name` was detected creating a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Ransomware Files Encrypted Prevented alert Ransomware Files Encrypted Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: files-encrypted ``` ### Sample Ransomware Files Encrypted Prevented alert  `DESKTOP-1` ransomware was prevented from encrypting files via `powershell.exe` (`6056`) `powershell.exe` `-file` `mock_ransomware_v3.ps1` via parent process `cmd.exe` (`10680`) with result `success` `e9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7` ### Fields in a Ransomware Files Encrypted Prevented alert `user.name` \ `user.domain` @ `host.name` ransomware was prevented from encrypting files via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Ransomware Files Encrypted Detected alert Ransomware Files Encrypted Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: files-encrypted ``` ### Sample Ransomware Files Encrypted Detected alert  `DESKTOP-1` ransomware was detected encrypting files via `powershell.exe` (`4684`) `powershell.exe` `-file` `mock_ransomware_v3.ps1` via parent process `cmd.exe` (`8616`) with result `success` `e9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7` ### Fields in a Ransomware Files Encrypted Detected alert `user.name` \ `user.domain` @ `host.name` ransomware was detected encrypting files via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Malware File Modification Prevented alert Malware File Modification Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: modification ``` ### Sample Malware File Modification Prevented alert  `win2019-endpoint-1` was prevented from modifying a malicious file `mimikatz - Copy.exe` in `C:\Users\sean\Downloads\mimikatz_trunk (1)\x64\mimikatz - Copy.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc` ### Fields in a Malware File Modification Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from modifying a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Modification Detected alert Malware File Modification Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: modification ``` ### Sample Malware File Modification Detected alert  `mac-1.local` was detected modifying a malicious file `aircrack` in `/private/var/root/write_malware/modules/write_malware/aircrack` via `Python` (`5995`) `/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python` `main.py` `-a` `modify` via parent process `Python` (`97`) with result `success` `f0954d9673878b2223b00b7ec770c7b438d876a9bb44ec78457e5c618f31f52b` ### Fields in a Malware File Modification Detected alert `user.name` \ `user.domain` @ `host.name` was detected modifying a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Rename Prevented alert Malware File Rename Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: file and event.action: rename ``` ### Sample Malware File Rename Prevented alert  `win2019-endpoint-1` was prevented from renaming a malicious file `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` in `C:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97` ### Fields in a Malware File Rename Prevented alert `user.name` \ `user.domain` @ `host.name` was prevented from renaming a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware File Rename Detected alert Malware File Rename Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: file and event.action: rename ``` ### Sample Malware File Rename Detected alert  `win2019-endpoint-1` was detected renaming a malicious file `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` in `C:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exe` via `explorer.exe` (`1008`) `C:\Windows\Explorer.EXE` via parent process `C:\Windows\System32\userinit.exe` (`356`) with result `success` `23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97` ### Fields in a Malware File Rename Detected alert `user.name` \ `user.domain` @ `host.name` was detected renaming a malicious file `file.name` in `file.path` via `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `file.hash.sha256` ## Malware Process Execution Prevented alert Malware Process Execution Prevented alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: denied and event.category: process and event.action: execution ``` ### Sample Malware Process Execution Prevented alert  `win2019-endpoint-1` was prevented from executing a malicious process `C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe` (`6920`) `C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe` via parent process `explorer.exe` (`1008`) with result `success` `3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb` ### Fields in a Sample Malware Process Execution Prevented alert `host.name` was prevented from executing a malicious process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## Malware Process Execution Detected alert Malware Process Execution Detected alerts with the following `event.dataset`, `event.type`, `event.category`, and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.alerts and event.type: allowed and event.category: process and event.action: execution ``` ### Sample Malware Process Execution Detected alert  `DESKTOP-1` was detected executing a malicious process `mimikatz_write.exe` (`8668`) `c:\temp\mimikatz_write.exe` via parent process `python.exe` (`4400`) with result `success` `263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0` ### Fields in a Sample Malware Process Execution Detected alert `host.name` was detected executing a malicious process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) with result `event.outcome` `process.hash.sha256` ## File (FIM) Modification events Endpoint File (FIM) Modification events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: modification ``` ### Sample rendered File (FIM) Modification event Each field with `this formatting` is draggable (to pivot a search) in the row-rendered event:  `admin` @ `test-Mac.local` modified a file `.dat.nosync01a5.6hoWv1` in `/Users/admin/Library/Application Support/CrashReporter/.dat.nosync01a5.6hoWv1` via `diagnostics_agent` `(421)` ### Fields in a File (FIM) Modification event `user.name` \ `user.domain` @ `host.name` modified a file `file.name` in `file.path` via `process.name` `(process.pid)` ## File (FIM) Overwrite events Endpoint File (FIM) Overwrite events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: overwrite ``` ### Sample rendered File (FIM) Overwrite event  `LOCAL SERVICE` \ `NT AUTHORITY` @ `windows-endpoint-1` overwrote a file `lastalive0.dat` in `C:\Windows\ServiceState\EventLog\Data\lastalive0.dat` via `svchost.exe` `(1228)` ### Fields in a File (FIM) Overwrite event `user.name` \ `user.domain` @ `host.name` overwrote a file `file.name` in `file.path` via `process.name` `(process.pid)` ## File (FIM) Rename events Endpoint File (FIM) Rename events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.file and event.action: rename ``` ### Sample rendered File (FIM) Rename event  `LOCAL SERVICE` \ `NT AUTHORITY` @ `windows-endpoint-1` renamed a file `SRU.log` in `C:\Windows\System32\sru\SRU.log` from its original path `C:\Windows\System32\sru\SRUtmp.log` via `svchost.exe` `(1204)` ### Fields in a File (FIM) Rename event `user.name` \ `user.domain` @ `host.name` renamed a file `file.name` in `file.path` from its original path `file.Ext.original.path` via `process.name` `(process.pid)` ## Registry Modification events Registry Modification events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.registry and event.action: modification ``` ### Sample Registry Modification event  `SYSTEM` \ `NT AUTHORITY` @ `win2019-endpoint-1` modified registry key `SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState` with new value `HKLM\SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue` via `GoogleUpdate.exe` `(7408)` ### Fields in a Registry Modification event `user.name` \ `user.domain` @ `host.name` modified registry key `registry.key` with new value `registry.path` via `process.name` `(process.pid)` ## Library Load events Library Load events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.library and event.action: load ``` ### Sample Library Load event  `SYSTEM` \ `NT AUTHORITY` @ `win2019-endpoint-1` loaded library `bcrypt.dll` in `C:\Windows\System32\bcrypt.dll` via `sshd.exe` `(9644)` `e70f5d8f87aab14e3160227d38387889befbe37fa4f8f5adc59eff52804b35fd` `2c4ba5c1482987d50a182bad915f52cd6611ee63` `00439016776de367bad087d739a03797` ### Fields in a Library Load event `user.name` \ `user.domain` @ `host.name` loaded library `file.name` in `file.path` via `process.name` `(process.pid)` `file.hash.sha256` `file.hash.sha1` `file.hash.md5` ## HTTP Request events HTTP Request events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.network and event.action: http_request ``` ### Sample HTTP Request event  Network HTTP Request events, like the one in the screenshot above, are also rendered by the Netflow row renderer, which displays information that includes the directionality of the connection, protocol, and source / destination details. `NETWORK SERVICE` \ `NT AUTHORITY` @ `win2019-endpoint-1` made a http request via `svchost.exe` `(2232)` ### Fields in a HTTP Request event `user.name` \ `user.domain` @ `host.name` made a http request via `process.name` `(process.pid)` ## Process Exec events Endpoint Process Exec events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.process and event.action: exec ``` ### Sample rendered Process Exec event  `admin` @ `test-mac.local` executed process `mdworker_shared` (`4454`) `/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared` `-s` `mdworker` `-c` `MDSImporterWorker` `-m` `com.apple.mdworker.shared` via parent process `launchd` (`1`) `4bc018ac461706496302d1faab0a8bb39aad974eb432758665103165f3a2dd2b` ### Fields in a Process Exec event The following fields will be used to render a Process Exec event: `user.name` @ `host.name` executed process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) `process.hash.sha256` ## Process Fork events Endpoint Process Fork events with the following `event.dataset` and `event.action` will be rendered in Timeline via row renderers: ``` event.dataset: endpoint.events.process and event.action: fork ``` ### Sample rendered Process Fork event  `admin` @ `test-mac.local` forked process `zoom.us` (`4042`) `/Applications/zoom.us.app/Contents/MacOS/zoom.us` via parent process `zoom.us` (`3961`) `cbf3d059cc9f9c0adff5ef15bf331b95ab381837fa0adecd965a41b5846f4bd4` ### Fields in a Process Fork event The following fields will be used to render a Process Exec event: `user.name` @ `host.name` forked process `process.name` (`process.pid`) `process.args` via parent process `process.parent.name` (`process.parent.pid`) `process.hash.sha256`
gmmorris
added a commit
to gmmorris/kibana
that referenced
this pull request
Feb 17, 2021
* master: (157 commits) [DOCS] Adds machine learning to the security section of alerting (elastic#91501) [Uptime] Ping list step screenshot caption formatting (elastic#91403) [Vislib] Use timestamp on brush event instead of iso dates (elastic#91483) [Application Usage] Remove deprecated & unused legacy.appChanged API (elastic#91464) Migrate logstash, monitoring, url_drilldowns, xpack_legacy to ts projects (elastic#91194) [APM] Wrap Elasticsearch client errors (elastic#91125) [APM] Fix optimize-tsconfig script (elastic#91487) [Discover][docs] Add searchFieldsFromSource description (elastic#90980) Adds support for 'ip' data type (elastic#85087) [Detection Rules] Add updates from 7.11.2 rules (elastic#91553) [SECURITY SOLUTION] Eql in timeline (elastic#90816) [APM] Correlations Beta (elastic#86477) (elastic#89952) [Security Solutions][Detection Engine] Adds a warning banner when the alerts data has not been migrated yet. (elastic#90258) [Security Solution] [Timeline] Endpoint row renderers (2nd batch) (elastic#91446) skip flaky suite (elastic#91450) skip flaky suite (elastic#91592) [Security Solution][Endpoint][Admin] Endpoint Details UX Enhancements (elastic#90870) [ML] Add better UI support for runtime fields Transforms (elastic#90363) [Security Solution] [Detections] Replace 'partial failure' with 'warning' for rule statuses (elastic#91167) [Security Solution][Detections] Adds Indicator path config for indicator match rules (elastic#91260) ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[Security Solution] [Timeline] Endpoint row renderers (2nd batch)
This PR implements the 2nd batch of Endpoint row renderers, including the new Ransomware alerts, by adding new row renderers for the following Endpoint alerts and events:
Other updates:
file.hash.sha256andprocess.hash.sha256. (Thesha1andmd5hashes will no longer be displayed)Malware File Creation Prevented alert
Malware File Creation Prevented alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware File Creation Prevented alert
win2019-endpoint-1was prevented from creating a malicious file6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmpinC:\Users\sean\Downloads\6a5eabd6-1c79-4962-b411-a5e7d9e967d4.tmpviachrome.exe(8944)C:\Program Files\Google\Chrome\Application\chrome.exevia parent processexplorer.exe(1008) with resultsuccess7cc42618e580f233fee47e82312cc5c3476cb5de9219ba3f9eb7f99ac0659c30Fields in a Malware File Creation Prevented alert
user.name\user.domain@host.namewas prevented from creating a malicious filefile.nameinfile.pathviaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomefile.hash.sha256Malware File Creation Detected alert
Malware File Creation Detected alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware File Creation Detected alert
DESKTOP-1was detected creating a malicious filemimikatz_write.exeinC:\temp\mimikatz_write.exeviapython.exe(4400)C:\Python27\python.exemain.py-aexecute-pc:\tempvia parent processpythonservice.exe(2936) with resultsuccess263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0Fields in a Malware File Creation Detected alert
user.name\user.domain@host.namewas detected creating a malicious filefile.nameinfile.pathviaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomefile.hash.sha256Ransomware Files Encrypted Prevented alert
Ransomware Files Encrypted Prevented alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Ransomware Files Encrypted Prevented alert
DESKTOP-1ransomware was prevented from encrypting files viapowershell.exe(6056)powershell.exe-filemock_ransomware_v3.ps1via parent processcmd.exe(10680) with resultsuccesse9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7Fields in a Ransomware Files Encrypted Prevented alert
user.name\user.domain@host.nameransomware was prevented from encrypting files viaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomeprocess.hash.sha256Ransomware Files Encrypted Detected alert
Ransomware Files Encrypted Detected alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Ransomware Files Encrypted Detected alert
DESKTOP-1ransomware was detected encrypting files viapowershell.exe(4684)powershell.exe-filemock_ransomware_v3.ps1via parent processcmd.exe(8616) with resultsuccesse9fa973eb5ad446e0be31c7b8ae02d48281319e7f492e1ddaadddfbdd5b480c7Fields in a Ransomware Files Encrypted Detected alert
user.name\user.domain@host.nameransomware was detected encrypting files viaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomeprocess.hash.sha256Malware File Modification Prevented alert
Malware File Modification Prevented alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware File Modification Prevented alert
win2019-endpoint-1was prevented from modifying a malicious filemimikatz - Copy.exeinC:\Users\sean\Downloads\mimikatz_trunk (1)\x64\mimikatz - Copy.exeviaexplorer.exe(1008)C:\Windows\Explorer.EXEvia parent processC:\Windows\System32\userinit.exe(356) with resultsuccess31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fcFields in a Malware File Modification Prevented alert
user.name\user.domain@host.namewas prevented from modifying a malicious filefile.nameinfile.pathviaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomefile.hash.sha256Malware File Modification Detected alert
Malware File Modification Detected alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware File Modification Detected alert
mac-1.localwas detected modifying a malicious fileaircrackin/private/var/root/write_malware/modules/write_malware/aircrackviaPython(5995)/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Pythonmain.py-amodifyvia parent processPython(97) with resultsuccessf0954d9673878b2223b00b7ec770c7b438d876a9bb44ec78457e5c618f31f52bFields in a Malware File Modification Detected alert
user.name\user.domain@host.namewas detected modifying a malicious filefile.nameinfile.pathviaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomefile.hash.sha256Malware File Rename Prevented alert
Malware File Rename Prevented alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware File Rename Prevented alert
win2019-endpoint-1was prevented from renaming a malicious file23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exeinC:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exeviaexplorer.exe(1008)C:\Windows\Explorer.EXEvia parent processC:\Windows\System32\userinit.exe(356) with resultsuccess23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97Fields in a Malware File Rename Prevented alert
user.name\user.domain@host.namewas prevented from renaming a malicious filefile.nameinfile.pathviaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomefile.hash.sha256Malware File Rename Detected alert
Malware File Rename Detected alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware File Rename Detected alert
win2019-endpoint-1was detected renaming a malicious file23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exeinC:\Users\sean\Downloads\23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97.exeviaexplorer.exe(1008)C:\Windows\Explorer.EXEvia parent processC:\Windows\System32\userinit.exe(356) with resultsuccess23361f8f413dd9258545030e42056a352fe35f66bac376d49954551c9b4bcf97Fields in a Malware File Rename Detected alert
user.name\user.domain@host.namewas detected renaming a malicious filefile.nameinfile.pathviaprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomefile.hash.sha256Malware Process Execution Prevented alert
Malware Process Execution Prevented alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware Process Execution Prevented alert
win2019-endpoint-1was prevented from executing a malicious processC:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe(6920)C:\Users\sean\Downloads\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exevia parent processexplorer.exe(1008) with resultsuccess3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fbFields in a Sample Malware Process Execution Prevented alert
host.namewas prevented from executing a malicious processprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomeprocess.hash.sha256Malware Process Execution Detected alert
Malware Process Execution Detected alerts with the following
event.dataset,event.type,event.category, andevent.actionwill be rendered in Timeline via row renderers:Sample Malware Process Execution Detected alert
DESKTOP-1was detected executing a malicious processmimikatz_write.exe(8668)c:\temp\mimikatz_write.exevia parent processpython.exe(4400) with resultsuccess263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0Fields in a Sample Malware Process Execution Detected alert
host.namewas detected executing a malicious processprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid) with resultevent.outcomeprocess.hash.sha256File (FIM) Modification events
Endpoint File (FIM) Modification events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample rendered File (FIM) Modification event
Each field with
this formattingis draggable (to pivot a search) in the row-rendered event:admin@test-Mac.localmodified a file.dat.nosync01a5.6hoWv1in/Users/admin/Library/Application Support/CrashReporter/.dat.nosync01a5.6hoWv1viadiagnostics_agent(421)Fields in a File (FIM) Modification event
user.name\user.domain@host.namemodified a filefile.nameinfile.pathviaprocess.name(process.pid)File (FIM) Overwrite events
Endpoint File (FIM) Overwrite events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample rendered File (FIM) Overwrite event
LOCAL SERVICE\NT AUTHORITY@windows-endpoint-1overwrote a filelastalive0.datinC:\Windows\ServiceState\EventLog\Data\lastalive0.datviasvchost.exe(1228)Fields in a File (FIM) Overwrite event
user.name\user.domain@host.nameoverwrote a filefile.nameinfile.pathviaprocess.name(process.pid)File (FIM) Rename events
Endpoint File (FIM) Rename events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample rendered File (FIM) Rename event
LOCAL SERVICE\NT AUTHORITY@windows-endpoint-1renamed a fileSRU.loginC:\Windows\System32\sru\SRU.logfrom its original pathC:\Windows\System32\sru\SRUtmp.logviasvchost.exe(1204)Fields in a File (FIM) Rename event
user.name\user.domain@host.namerenamed a filefile.nameinfile.pathfrom its original pathfile.Ext.original.pathviaprocess.name(process.pid)Registry Modification events
Registry Modification events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample Registry Modification event
SYSTEM\NT AUTHORITY@win2019-endpoint-1modified registry keySOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentStatewith new valueHKLM\SOFTWARE\WOW6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValueviaGoogleUpdate.exe(7408)Fields in a Registry Modification event
user.name\user.domain@host.namemodified registry keyregistry.keywith new valueregistry.pathviaprocess.name(process.pid)Library Load events
Library Load events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample Library Load event
SYSTEM\NT AUTHORITY@win2019-endpoint-1loaded librarybcrypt.dllinC:\Windows\System32\bcrypt.dllviasshd.exe(9644)e70f5d8f87aab14e3160227d38387889befbe37fa4f8f5adc59eff52804b35fd2c4ba5c1482987d50a182bad915f52cd6611ee6300439016776de367bad087d739a03797Fields in a Library Load event
user.name\user.domain@host.nameloaded libraryfile.nameinfile.pathviaprocess.name(process.pid)file.hash.sha256file.hash.sha1file.hash.md5HTTP Request events
HTTP Request events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample HTTP Request event
Network HTTP Request events, like the one in the screenshot above, are also rendered by the Netflow row renderer, which displays information that includes the directionality of the connection, protocol, and source / destination details.
NETWORK SERVICE\NT AUTHORITY@win2019-endpoint-1made a http request viasvchost.exe(2232)Fields in a HTTP Request event
user.name\user.domain@host.namemade a http request viaprocess.name(process.pid)Process Exec events
Endpoint Process Exec events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample rendered Process Exec event
admin@test-mac.localexecuted processmdworker_shared(4454)/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared-smdworker-cMDSImporterWorker-mcom.apple.mdworker.sharedvia parent processlaunchd(1)4bc018ac461706496302d1faab0a8bb39aad974eb432758665103165f3a2dd2bFields in a Process Exec event
The following fields will be used to render a Process Exec event:
user.name@host.nameexecuted processprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid)process.hash.sha256Process Fork events
Endpoint Process Fork events with the following
event.datasetandevent.actionwill be rendered in Timeline via row renderers:Sample rendered Process Fork event
admin@test-mac.localforked processzoom.us(4042)/Applications/zoom.us.app/Contents/MacOS/zoom.usvia parent processzoom.us(3961)cbf3d059cc9f9c0adff5ef15bf331b95ab381837fa0adecd965a41b5846f4bd4Fields in a Process Fork event
The following fields will be used to render a Process Exec event:
user.name@host.nameforked processprocess.name(process.pid)process.argsvia parent processprocess.parent.name(process.parent.pid)process.hash.sha256