Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add registry mappings #117

Merged
merged 7 commits into from
Jul 10, 2023
Merged

Add registry mappings #117

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
13c0b26
Merge pull request #2 from redcanaryco/master
xC0uNt3r7hr34t Jul 6, 2023
8136e94
add regmod param mappings
Jul 6, 2023
7d55dd6
fix search_value issue
Jul 6, 2023
685454b
Update products/microsoft_defender_for_endpoints.py
xC0uNt3r7hr34t Jul 10, 2023
05b9b61
Merge branch 'master' into add-registry-mappings
rc-csmith Jul 10, 2023
63a2518
add ipport and regmod to test data
rc-csmith Jul 7, 2023
45bb6b8
add regmod and ipport coverage in tests
rc-csmith Jul 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion products/microsoft_defender_for_endpoints.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,9 @@
'sha256':{'table':'DeviceProcessEvents','field':'SHA256',
'projections':['DeviceName','AccountName','FolderPath','ProcessCommandLine']},
'modload':{'table': 'DeviceImageLoadEvents', 'field':'FolderPath',
'projections':['DeviceName', 'InitiatingProcessAccountName', 'InitiatingProcessFolderPath', 'InitiatingProcessCommandLine']}
'projections':['DeviceName', 'InitiatingProcessAccountName', 'InitiatingProcessFolderPath', 'InitiatingProcessCommandLine']},
'regmod':{'table':'DeviceRegistryEvents','field':'RegistryKey',
'projections':['DeviceName', 'InitiatingProcessAccountName', 'InitiatingProcessFolderPath', 'InitiatingProcessCommandLine', 'RegistryValueName', 'RegistryValueData']}
}

class DefenderForEndpoints(Product):
Expand Down
11 changes: 7 additions & 4 deletions products/sentinel_one.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,8 @@ class Query:
'process_file_description': ['SrcProcDisplayName'],
'md5': ['Md5'],
'sha1':['Sha1'],
'sha256':['Sha256']
'sha256':['Sha256'],
'regmod':['RegistryKeyPath','RegistryValue']
}

PARAMETER_MAPPING_PQ: dict[str, list[str]] = {
Expand All @@ -67,7 +68,8 @@ class Query:
'process_file_description': ['src.process.displayName'],
'md5': ['src.process.image.md5', 'tgt.file.md5', 'module.md5'],
'sha256':['src.process.image.sha256','tgt.file.sha256'],
'sha1':['src.process.image.sha1','tgt.file.sha1','module.sha1']
'sha1':['src.process.image.sha1','tgt.file.sha1','module.sha1'],
'regmod':['registry.keyPath','registry.value']
}

class SentinelOne(Product):
Expand Down Expand Up @@ -519,9 +521,10 @@ def nested_process_search(self, tag: Tag, criteria: dict, base_query: dict) -> N
# play nice with 100 item limit per search field
chunked_terms = list(self.divide_chunks(terms, 100))
for chunk in chunked_terms:
search_value = ', '.join(f'"{x}"' for x in chunk)

search_value_orig = ', '.join(f'"{x}"' for x in chunk)
for param in parameter:
search_value = search_value_orig
if param == 'query':
# Formats queries as (a) OR (b) OR (c) OR (d)
if len(chunk) > 1:
Expand Down
3 changes: 2 additions & 1 deletion products/vmware_cb_enterprise_edr.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
'domain': 'netconn_domain',
'internal_name': 'process_internal_name',
'md5':'hash',
'sha256':'hash'
'sha256':'hash',
'regmod':'regmod_name'
}

def _convert_relative_time(relative_time) -> str:
Expand Down