Merge branch 'develop' into innoloader

Author: pyth0n1c

contentctl.yml

@@ -71,9 +71,9 @@ apps:
 - uid: 5709
   title: Splunk Add-on for Sysmon
   appid: Splunk_TA_microsoft_sysmon
-  version: 4.0.2
+  version: 4.0.3
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-sysmon_402.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-sysmon_403.tgz
 - uid: 833
   title: Splunk Add-on for Unix and Linux
   appid: Splunk_TA_nix
@@ -83,9 +83,9 @@ apps:
 - uid: 5579
   title: Splunk Add-on for CrowdStrike FDR
   appid: Splunk_TA_CrowdStrike_FDR
-  version: 2.0.3
+  version: 2.0.5
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_203.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_205.tgz
 - uid: 3185
   title: Splunk Add-on for Microsoft IIS
   appid: SPLUNK_TA_FOR_IIS
@@ -185,9 +185,9 @@ apps:
 - uid: 6207
   title: Splunk Add-on for Microsoft Security
   appid: Splunk_TA_MS_Security
-  version: 2.5.0
+  version: 2.5.2
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_250.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_252.tgz
 - uid: 2734
   title: URL Toolbox
   appid: URL_TOOLBOX

data_sources/crowdstrike_processrollup2.yml

@@ -19,7 +19,7 @@ separator_value: ProcessRollup2
 supported_TA:
 - name: Splunk Add-on for CrowdStrike FDR
   url: https://splunkbase.splunk.com/app/5579
-  version: 2.0.4
+  version: 2.0.5
 fields:
 - AuthenticationId
 - AuthenticationId_meaning
@@ -100,26 +100,26 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-  - action 
-  - dest 
-  - original_file_name 
-  - parent_process 
-  - parent_process_exec 
-  - parent_process_guid 
-  - parent_process_id 
-  - parent_process_name 
-  - parent_process_path 
-  - process 
-  - process_exec 
-  - process_guid 
-  - process_hash 
-  - process_id 
-  - process_integrity_level 
-  - process_name 
-  - process_path 
-  - user 
-  - user_id
-  - vendor_product
+- action
+- dest
+- original_file_name
+- parent_process
+- parent_process_exec
+- parent_process_guid
+- parent_process_id
+- parent_process_name
+- parent_process_path
+- process
+- process_exec
+- process_guid
+- process_hash
+- process_id
+- process_integrity_level
+- process_name
+- process_path
+- user
+- user_id
+- vendor_product
 field_mappings:
 - data_model: cim
   data_set: Endpoint.Processes

data_sources/ms365_defender_incident_alerts.yml

@@ -16,7 +16,7 @@ sourcetype: ms365:defender:incident:alerts
 supported_TA:
 - name: Splunk Add-on for Microsoft Security
   url: https://splunkbase.splunk.com/app/6207
-  version: 2.5.0
+  version: 2.5.2
 fields:
 - actorName
 - alertId

data_sources/ms_defender_atp_alerts.yml

@@ -16,7 +16,7 @@ sourcetype: ms:defender:atp:alerts
 supported_TA:
 - name: Splunk Add-on for Microsoft Security
   url: https://splunkbase.splunk.com/app/6207
-  version: 2.5.0
+  version: 2.5.2
 fields:
 - column
 - accountName

data_sources/splunk_common_information_model_(cim).yml

@@ -9,4 +9,4 @@ sourcetype: not_applicable
 supported_TA:
 - name: Splunk Common Information Model (CIM)
   url: https://splunkbase.splunk.com/app/1621
-  version: 6.0.4
+  version: 6.1.0

data_sources/sysmon_eventid_1.yml

@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -118,26 +118,26 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-  - action 
-  - dest 
-  - original_file_name 
-  - parent_process 
-  - parent_process_exec 
-  - parent_process_guid 
-  - parent_process_id 
-  - parent_process_name 
-  - parent_process_path 
-  - process 
-  - process_exec 
-  - process_guid 
-  - process_hash 
-  - process_id 
-  - process_integrity_level 
-  - process_name 
-  - process_path 
-  - user 
-  - user_id
-  - vendor_product
+- action
+- dest
+- original_file_name
+- parent_process
+- parent_process_exec
+- parent_process_guid
+- parent_process_id
+- parent_process_name
+- parent_process_path
+- process
+- process_exec
+- process_guid
+- process_hash
+- process_id
+- process_integrity_level
+- process_name
+- process_path
+- user
+- user_id
+- vendor_product
 field_mappings:
 - data_model: cim
   data_set: Endpoint.Processes
@@ -178,22 +178,23 @@ convert_to_log_source:
     User: UserSid
     ParentProcessId: ParentProcessId
     ParentImage: ParentBaseFileName
-example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
-  Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
-  SystemTime='2020-10-08T11:03:46.617920300Z'/><EventRecordID>4522</EventRecordID><Correlation/><Execution
-  ProcessID='2912' ThreadID='3424'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-6764986.attackrange.local</Computer><Security
-  UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2020-10-08
-  11:03:46.615</Data><Data Name='ProcessGuid'>{96128EA2-F212-5F7E-E400-000000007F01}</Data><Data
-  Name='ProcessId'>2296</Data><Data Name='Image'>C:\Windows\System32\cmd.exe</Data><Data
-  Name='FileVersion'>10.0.14393.0 (rs1_release.160715-1616)</Data><Data Name='Description'>Windows
-  Command Processor</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data
-  Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>Cmd.Exe</Data><Data
-  Name='CommandLine'>"C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %%temp%%\sam
-  &amp; reg save HKLM\system %%temp%%\system &amp; reg save HKLM\security %%temp%%\security"
-  </Data><Data Name='CurrentDirectory'>C:\Users\ADMINI~1\AppData\Local\Temp\</Data><Data
-  Name='User'>ATTACKRANGE\Administrator</Data><Data Name='LogonGuid'>{96128EA2-F210-5F7E-ACD4-080000000000}</Data><Data
-  Name='LogonId'>0x8d4ac</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>High</Data><Data
-  Name='Hashes'>MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A</Data><Data
-  Name='ParentProcessGuid'>{96128EA2-F211-5F7E-DF00-000000007F01}</Data><Data Name='ParentProcessId'>4624</Data><Data
-  Name='ParentImage'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data
-  Name='ParentCommandLine'>"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==</Data></EventData></Event>
+example_log: "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider\
+  \ Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated\
+  \ SystemTime='2020-10-08T11:03:46.617920300Z'/><EventRecordID>4522</EventRecordID><Correlation/><Execution\
+  \ ProcessID='2912' ThreadID='3424'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-6764986.attackrange.local</Computer><Security\
+  \ UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2020-10-08\
+  \ 11:03:46.615</Data><Data Name='ProcessGuid'>{96128EA2-F212-5F7E-E400-000000007F01}</Data><Data\
+  \ Name='ProcessId'>2296</Data><Data Name='Image'>C:\\Windows\\System32\\cmd.exe</Data><Data\
+  \ Name='FileVersion'>10.0.14393.0 (rs1_release.160715-1616)</Data><Data Name='Description'>Windows\
+  \ Command Processor</Data><Data Name='Product'>Microsoft\xAE Windows\xAE Operating\
+  \ System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>Cmd.Exe</Data><Data\
+  \ Name='CommandLine'>\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam\
+  \ %%temp%%\\sam &amp; reg save HKLM\\system %%temp%%\\system &amp; reg save HKLM\\\
+  security %%temp%%\\security\" </Data><Data Name='CurrentDirectory'>C:\\Users\\ADMINI~1\\\
+  AppData\\Local\\Temp\\</Data><Data Name='User'>ATTACKRANGE\\Administrator</Data><Data\
+  \ Name='LogonGuid'>{96128EA2-F210-5F7E-ACD4-080000000000}</Data><Data Name='LogonId'>0x8d4ac</Data><Data\
+  \ Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>High</Data><Data\
+  \ Name='Hashes'>MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A</Data><Data\
+  \ Name='ParentProcessGuid'>{96128EA2-F211-5F7E-DF00-000000007F01}</Data><Data Name='ParentProcessId'>4624</Data><Data\
+  \ Name='ParentImage'>C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe</Data><Data\
+  \ Name='ParentCommandLine'>\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==</Data></EventData></Event>"

data_sources/sysmon_eventid_10.yml

@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - CallTrace
@@ -101,16 +101,16 @@ fields:
 output_fields:
 - dest
 - user_id
-- parent_process_name 
-- parent_process_guid 
-- process_name 
-- process_guid 
-- process_id 
-- signature 
-- SourceImage 
-- TargetImage 
-- GrantedAccess 
-- CallTrace 
+- parent_process_name
+- parent_process_guid
+- process_name
+- process_guid
+- process_id
+- signature
+- SourceImage
+- TargetImage
+- GrantedAccess
+- CallTrace
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>10</EventID><Version>3</Version><Level>4</Level><Task>10</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
   SystemTime='2022-02-01T21:01:44.672666100Z'/><EventRecordID>150624412</EventRecordID><Correlation/><Execution

data_sources/sysmon_eventid_11.yml

@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -93,14 +93,14 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- file_name 
-- file_path 
-- process_guid 
-- process_id 
-- user 
-- vendor_product 
+- action
+- dest
+- file_name
+- file_path
+- process_guid
+- process_id
+- user
+- vendor_product
 field_mappings:
 - data_model: cim
   data_set: Endpoint.Filesystem

data_sources/sysmon_eventid_12.yml

@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -95,15 +95,15 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- process_guid 
-- process_id 
-- registry_hive 
-- registry_path 
-- registry_key_name 
-- status 
-- user 
+- action
+- dest
+- process_guid
+- process_id
+- registry_hive
+- registry_path
+- registry_key_name
+- status
+- user
 - vendor_product
 field_mappings:
 - data_model: cim

data_sources/sysmon_eventid_13.yml

@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -102,17 +102,17 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- process_guid 
-- process_id 
-- registry_hive 
-- registry_path 
-- registry_key_name 
-- registry_value_data 
-- registry_value_name 
-- status 
-- user 
+- action
+- dest
+- process_guid
+- process_id
+- registry_hive
+- registry_path
+- registry_key_name
+- registry_value_data
+- registry_value_name
+- status
+- user
 - vendor_product
 field_mappings:
 - data_model: cim