total_replay_tool

Author: t-contreras

total_replay/configuration/config.yml

@@ -1,12 +1,7 @@
 settings:
   security_content_detection_path: ~/path/to/your/security_content/detections
-  attack_range_dir_path: ~/path/to/your/attack_range
   attack_data_dir_path: ~/path/to/your/attack_data
-  attack_range_py_name: attack_range.py
   output_dir_name : output
   cache_replay_yaml_name : cache_replay_data.yml
   replayed_yaml_cache_dir_name: replayed_yaml_cache
-  python_interpreter_name: python3
-  attack_range_version_on: False
-  attack_data_version_on: True
   debug_print: False

total_replay/readme.md

@@ -9,37 +9,6 @@ This lightweight tool helps you make the most of Splunk’s [Security Content](h
 ## Installation
 
 ### MAC/LINUX:
-
-**How to install TOTAL-REPLAY when working with Splunk Attack Range or Splunk Attack Data**
-
-#### TOTAL-REPLAY IN SPLUNK ATTACK-RANGE REPO:
----
-
-1. Clone the Splunk Security Content github repo. We recommend to follow this steps [Security Content Getting Started](https://github.com/splunk/security_content).
-
-2. We recommend following the instructions in the [Attack Range Getting Started](https://github.com/splunk/attack_range)
- guide. Once Attack Range is installed and its virtual environment (managed via Poetry) is activated, TOTAL-REPLAY is almost ready to use — you just need to configure it.
-
-3. In total_replay->configuration->config.yml, add the folder path of the Splunk Attack Data repo and the detection folder path in Splunk Security Content.
-
-```
-settings:
-  security_content_detection_path: ~/path/to/your/security_content/detections
-  attack_range_dir_path: ~/path/to/your/attack_range
-```
-
-4. Enable the `attack_range_version_on` config setting in total_replay->configuration->config.yml:
-   **NOTE: You can enable  either `attack_range_version_on` or `attack_data_version_on` settings**
-```
-attack_range_version_on: True
-```
-
-5. If you encounter problem with colorama python library just update it.
-```  
-poetry update colorama
-```
-
-#### TOTAL-REPLAY IN SPLUNK ATTACK-DATA REPO:
 ---
 
 1. Clone the Splunk Attack Data github repo. We recommend to follow this steps [Attack Data Getting Started](https://github.com/splunk/attack_data/).
@@ -90,6 +59,12 @@ attack_data_version_on: True
     export SPLUNK_HEC_TOKEN= <SPLUNK_HEC_TOKEN>
     ```
 
+10. Make sure HEC token is set to "Enabled" in Splunk server (Settings → Data Inputs → HTTP Event Collector).
+
+11. Confirm the HEC listener port is enabled, typically 8088, using HTTPS.
+
+12. Update your firewall settings to allow inbound connections on port 8088, otherwise your data sender will not be able to reach Splunk.
+
 ### Windows OS:
 
 We recommend using the Windows Subsystem for Linux (WSL). You can find a tutorial [here](https://learn.microsoft.com/en-us/windows/wsl/install). After installing WSL, you can follow the steps described in the Linux section.
@@ -112,7 +87,16 @@ A. This tool accepts the following types of metadata as input:
     - **Splunk detection GUIDs**
     - **Analytic stories**
 
-It then uses these inputs to identify and replay the attack data associated with them.
+  It then uses these inputs to identify and replay the attack data associated with them.
+
+  Example A - Replay Attack Data via Splunk detection name:
+
+  ```
+  python3 total_replay.py -n '7zip CommandLine To SMB Share Path, CMLUA Or CMSTPLUA UAC Bypass'
+  ```
+
+
+
 
 B. For automation, you can also provide a simple .txt file.
 For example:

total_replay/test/test_names.txt

@@ -1,13 +1,13 @@
-wsreset_uac_bypass.yml
+PromptLock
+Amos Stealer
 wscript_or_cscript_suspicious_child_process.yml
-windows_user_deletion_via_net.yml
-Windows User Disabled Via Net
-Windows Chromium Browser No Security Sandbox Process
+wmic_xsl_execution_via_url.yml
+windows_windbg_spawning_autoit3.yml
+Linux Auditd Change File Owner To Root
+f64579c0-203f-11ec-abcc-acde48001122
 004e32e2-146d-11ec-a83f-acde48001122
 01d29b48-ff6f-11eb-b81e-acde48001123
+6bc5243e-ef36-45dc-9b12-f4a6be131159
+453a6b0f-b0ea-48fa-9cf4-20537ffdd22c
+T1036.005
 #T1014
-T1589.001
-Amos Stealer
-PromptLock
-f64579c0-203f-11ec-abcc-acde48001122
-004e32e2-146d-11ec-a83f-acde48001122