Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Issues with recently added Script Activity class #1197

Closed
davemcatcisco opened this issue Oct 8, 2024 · 0 comments
Closed

Issues with recently added Script Activity class #1197

davemcatcisco opened this issue Oct 8, 2024 · 0 comments

Comments

@davemcatcisco
Copy link
Contributor

PR 1159 added the Script Activity event class to the schema. It was authored by myself and merged on 22nd August. Within a week of this, I realised on trying to implement this in our product there were two omissions in this original PR:

  1. I forgot to include an entry in the type_id enum for VBA macros as used in Word docs, Excel sheets, etc. As folks will no doubt be aware, this is one of the most common techniques used by adversaries.
  2. When a script is very large (e.g. Mimikatz) and the security product truncates what gets included in the script object, I forgot to provide a flag so that the product could indicate that it had truncated the script.

Additonally, at the time of the original PR I was asked to clarify the language in some of the descriptions for the new schema objects.

I actually did all of the above locally at the time but forgot to open an issue and PR here until about 10 minutes ago. Sorry! I'll open a PR for this issue in a few mins.
@davemcatcisco davemcatcisco mentioned this issue Oct 8, 2024
Merged
pagbabian-splunk pushed a commit that referenced this issue Oct 15, 2024
@davemcatcisco
Addressed a few issues with recent Script Activity PR. (#1198)
172ef9c 
#### Related Issue: 

#1197 

#### Description of changes:

As described in the issue but to recap:
- Added an ~`is_script_truncated`~ `is_script_content_truncated` flag.
- Added an entry to the `type_id` enum in the `script` object.
- Improved descriptions in previous PR as requested at the time.

Signed-off-by: Dave McCormack <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jonrau-at-queryai @davemcatcisco