diff --git a/CHANGELOG.md b/CHANGELOG.md index 8998a3e7a..becd4e899 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,6 +56,7 @@ Thankyou! --> 7. Added `is_alert` as a `boolean_t`, #1179 8. Added `working_directory` as a `string_t`. #1195 9. Added `is_deleted` a `boolean_t`. #1196 + 10. Added `is_script_content_truncated` as a `boolean_t`. #1198 * #### Objects 1. Added `environment_variable` object. #1172 @@ -81,6 +82,8 @@ Thankyou! --> 11. Added `http_headers` to `email` object. #1199 12. Added `working_directory` to `process` object. #1195 13. Added `is_deleted` to `file` object. #1196 + 14. Added `is_script_content_truncated` to `script` object. #1198 + 15. Added entry for VBA macros to `type_id` enum in `script` object. #1198 ### Bugfixes 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180 diff --git a/dictionary.json b/dictionary.json index 71c019e77..7ec41bce1 100644 --- a/dictionary.json +++ b/dictionary.json @@ -2508,6 +2508,11 @@ "description": "The indication of whether this is a lease/session renewal event.", "type": "boolean_t" }, + "is_script_content_truncated": { + "caption": "Is Script Content Truncated", + "description": "Indicates if the contents of the script_content attribute have been truncated.", + "type": "boolean_t" + }, "is_secure": { "caption": "Secure", "description": "The cookie attribute indicates that cookies are sent to the server only when the request is encrypted using the HTTPS protocol.", @@ -4014,7 +4019,7 @@ "script_content": { "observable": 36, "caption": "Script Content", - "description": "The script content, normalized to UTF-8 encoding irrespective of its original encoding.", + "description": "The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated.", "type": "string_t" }, "section_a": { diff --git a/objects/script.json b/objects/script.json index 6050053a1..53b19a7a6 100644 --- a/objects/script.json +++ b/objects/script.json @@ -12,8 +12,11 @@ "description": "An array of the script's cryptographic hashes. Note that these hashes are calculated on the script in its original encoding, and not on the normalized UTF-8 encoding found in the script_content attribute.", "requirement": "recommended" }, + "is_script_content_truncated": { + "requirement": "optional" + }, "parent_uid": { - "description": "When a script is a dynamically executed sub-script, and when the underlying script engine supports use of the uid attribute, this parent_uid attribute identifies the parent script.", + "description": "This attribute relates a sub-script to a parent script having the matching uid attribute. In the case of PowerShell, sub-script execution can be identified by matching the activity correlation ID of the raw ETW events provided by the OS.", "requirement": "optional" }, "script_content": { @@ -49,6 +52,9 @@ "6": { "caption": "Unix Shell" }, + "7": { + "caption": "VBA" + }, "99": { "caption": "Other", "description": "The script type is not mapped. See the type attribute which contains an event source specific value." @@ -56,7 +62,7 @@ } }, "uid": { - "description": "Some script engines assign a unique ID to each individual execution of a given script, e.g. PowerShell's Script Block ID. This uid attribute enables a dynamically executed sub-script to refer to its parent.", + "description": "Some script engines assign a unique ID to each individual execution of a given script. This attribute captures that unique ID. In the case of PowerShell, the unique ID corresponds to the ScriptBlockId in the raw ETW events provided by the OS.", "requirement": "optional" } }