diff --git a/filters/antivirus/deceptive-bytes.yml b/filters/antivirus/deceptive-bytes.yml index c44723e0c..dfaef3fda 100644 --- a/filters/antivirus/deceptive-bytes.yml +++ b/filters/antivirus/deceptive-bytes.yml @@ -184,7 +184,7 @@ pipeline: pattern: '\,{{.data}}\,' - fieldName: origin.path pattern: '{{.greedy}}\,' - - fieldName: command + - fieldName: origin.command pattern: '{{.greedy}}' source: log.restMessage @@ -412,14 +412,12 @@ pipeline: function: prefix substring: '"' fields: - - command - + - origin.command - trim: function: suffix substring: '"' fields: - - command - + - origin.command - trim: function: prefix substring: '[' @@ -455,31 +453,45 @@ pipeline: function: string params: key: actionResult - value: "blocked" - where: 'exists("log.action") && oneOf("log.action", ["blocked", "prevented"])' + value: denied + where: exists("log.action") && oneOf("log.action", ["blocked", "prevented"]) # Adding severity based on log.severityLabelCharacter - add: - function: 'string' + function: string params: key: severity - value: 'high' + value: error where: oneOf("log.severityLabelCharacter", ["C", "A", "E"]) - add: - function: 'string' + function: string params: key: severity - value: 'medium' + value: warning where: equals("log.severityLabelCharacter", "W") - add: - function: 'string' + function: string params: key: severity - value: 'low' + value: info where: oneOf("log.severityLabelCharacter", ["D", "V", "N", "I", "T"]) + # Normalize the source event severity. + - add: + function: string + params: + key: severity + value: critical + where: oneOf("log.severityLabelCharacter",["C","A"]) + - add: + function: string + params: + key: severity + value: debug + where: oneOf("log.severityLabelCharacter",["D","V","T"]) + # Removing unused fields - delete: fields: @@ -493,4 +505,4 @@ pipeline: - log.restMessageToKv - log.pidStatusToKv - log.userWithTrash - - log.severityLabelCharacter \ No newline at end of file + - log.severityLabelCharacter diff --git a/filters/audits/deceptive-bytes.md b/filters/audits/deceptive-bytes.md new file mode 100644 index 000000000..2e1d1a012 --- /dev/null +++ b/filters/audits/deceptive-bytes.md @@ -0,0 +1,40 @@ +# Deceptive Bytes normalization and rule review + +Use origin.command, canonical denied outcomes, and classify severity before cleanup. + +This draft targets UTMStack `v11`. It contains 1 filter changes +and 0 rule changes for this technology only. Review covered +1 filter configurations and 16 matching shipped rule files. +Unchanged rules are listed in the regression manifest; they are not duplicated in the diff. + +## Contract and validation + +- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries. +- Checked documented pipeline ordering, rename/move behavior, open vendor log fields, + event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping. +- Strict SDK configuration decoding and actual CEL compilation pass for this scope. +- 5 synthetic normalization cases pass, including SDK Event conversion and any + trigger predicate assertions recorded in the manifest. +- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied. + +The shared alert-contract PR supplies the reusable Go runner for the manifest in +`plugins/alerts/testdata/filter-contracts/deceptive-bytes.json`. Apply that support before running `go test ./...` in `plugins/alerts`. + +The model starts from synthetic extraction results. It does not run complex grok, +JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch +queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must +still be checked in staging before rollout. No customer false-positive reduction +has been measured and no production rollout is included. + + + +## References + +- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto) +- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference) +- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema) +- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules) + +`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom +`log.*` fields are accepted. Existing textual protocol casing and vendor action names +are preserved unless a concrete consumer mismatch requires correction. diff --git a/plugins/alerts/testdata/filter-contracts/deceptive-bytes.json b/plugins/alerts/testdata/filter-contracts/deceptive-bytes.json new file mode 100644 index 000000000..81f01098b --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/deceptive-bytes.json @@ -0,0 +1,136 @@ +{ + "technology": "Deceptive Bytes", + "filters": [ + "filters/antivirus/deceptive-bytes.yml" + ], + "rules": [ + "rules/antivirus/deceptive-bytes/advanced_threat_tactic_identification.yml", + "rules/antivirus/deceptive-bytes/criminal_group_signatures.yml", + "rules/antivirus/deceptive-bytes/data_theft_attempt_indicators.yml", + "rules/antivirus/deceptive-bytes/deception_api_call_tracking.yml", + "rules/antivirus/deceptive-bytes/deception_token_access_patterns.yml", + "rules/antivirus/deceptive-bytes/decoy_share_access_monitoring.yml", + "rules/antivirus/deceptive-bytes/decoy_system_enumeration.yml", + "rules/antivirus/deceptive-bytes/fake_user_authentication_attempts.yml", + "rules/antivirus/deceptive-bytes/honey_table_query_detection.yml", + "rules/antivirus/deceptive-bytes/lateral_movement_trap_triggers.yml", + "rules/antivirus/deceptive-bytes/living_off_the_land_detection.yml", + "rules/antivirus/deceptive-bytes/nation_state_tactic_detection.yml", + "rules/antivirus/deceptive-bytes/privilege_escalation_bait_detection.yml", + "rules/antivirus/deceptive-bytes/ransomware_behavior_patterns.yml", + "rules/antivirus/deceptive-bytes/threat_actor_attribution.yml", + "rules/antivirus/deceptive-bytes/zero_day_behavior_patterns.yml" + ], + "fixtures": [ + { + "name": "deceptive_severity_C", + "filter": "antivirus/deceptive-bytes.yml", + "input": { + "log": { + "severityLabelCharacter": "[C]", + "action": "blocked" + }, + "origin": { + "command": "\"example --flag\"" + } + }, + "expected": { + "severity": "critical", + "actionResult": "denied", + "origin.command": "example --flag" + }, + "absent": [ + "command" + ], + "rules": {} + }, + { + "name": "deceptive_severity_D", + "filter": "antivirus/deceptive-bytes.yml", + "input": { + "log": { + "severityLabelCharacter": "[D]", + "action": "blocked" + }, + "origin": { + "command": "\"example --flag\"" + } + }, + "expected": { + "severity": "debug", + "actionResult": "denied", + "origin.command": "example --flag" + }, + "absent": [ + "command" + ], + "rules": {} + }, + { + "name": "deceptive_severity_E", + "filter": "antivirus/deceptive-bytes.yml", + "input": { + "log": { + "severityLabelCharacter": "[E]", + "action": "blocked" + }, + "origin": { + "command": "\"example --flag\"" + } + }, + "expected": { + "severity": "error", + "actionResult": "denied", + "origin.command": "example --flag" + }, + "absent": [ + "command" + ], + "rules": {} + }, + { + "name": "deceptive_severity_W", + "filter": "antivirus/deceptive-bytes.yml", + "input": { + "log": { + "severityLabelCharacter": "[W]", + "action": "blocked" + }, + "origin": { + "command": "\"example --flag\"" + } + }, + "expected": { + "severity": "warning", + "actionResult": "denied", + "origin.command": "example --flag" + }, + "absent": [ + "command" + ], + "rules": {} + }, + { + "name": "deceptive_severity_I", + "filter": "antivirus/deceptive-bytes.yml", + "input": { + "log": { + "severityLabelCharacter": "[I]", + "action": "blocked" + }, + "origin": { + "command": "\"example --flag\"" + } + }, + "expected": { + "severity": "info", + "actionResult": "denied", + "origin.command": "example --flag" + }, + "absent": [ + "command" + ], + "rules": {} + } + ] +}