[8.16] Update WMI event fields and add missing custom documentation fields #546
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AsuNa-jp
force-pushed
the
8.16_events
branch
from
a20f980
to
679a388
Compare
|
Resolved the conflict between #545. |
pzl
approved these changes
Sep 20, 2024
|
Thanks for the review! |
intxgo
approved these changes
Sep 24, 2024
intxgo
reviewed
Sep 24, 2024
| @@ -1272,7 +1272,7 @@ | |||
| level: custom | |||
| type: keyword | |||
| ignore_above: 1024 | |||
| description: "A list of observed behaviors.\n \"cross-process\" - the observed activity was between two processes\n \"parent-child\" - the observed activity was between a parent process and its child\n \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n \"image_hooked\" - an entry in the callstack appears to have been hooked\n \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n \"image_rop\" - no call instruction preceded an entry in the call stack\n \"image_rwx\" - an entry in the callstack is writable\n \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n \"hardware_breakpoint_set\" - a hardware breakpoint was set\n \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n \"pid_spoofing\" - WMI client proceess passed a forged process ID to the WMI server to spoof their origin" | |||
| description: "A list of observed behaviors.\n \"cross-process\" - the observed activity was between two processes\n \"parent-child\" - the observed activity was between a parent process and its child\n \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n \"image_hooked\" - an entry in the callstack appears to have been hooked\n \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n \"image_rop\" - no call instruction preceded an entry in the call stack\n \"image_rwx\" - an entry in the callstack is writable\n \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n \"hardware_breakpoint_set\" - a hardware breakpoint was set\n \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n \"legacy_api\" - a deprecated or superseded API was called" | |||
There was a problem hiding this comment.
- call stack is unexpected truncated due to malicious tampering or system load
+ call stack is unexpectedly truncated due to malicious tampering or system load
- a region of non-image executable memory allocated more executable memory
+ a region of non-image executable memory allocated executable memory
- a region of non-image executable memory was unexpectedly transferred control
+ control was transferred unexpectedly to a region of non-image executable memorySome descriptions seems oddly worded, just my suggestion, not necessarily correct
There was a problem hiding this comment.
You’re right, the wording is indeed a bit odd. I’ll check with John, but for now, I’ll go ahead and merge this PR as it is!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change Summary
process.Ext.api.parameters.operationfield (which I forgot to include it in the previous PR)Sample values
Below are examples of the custom API fields (
process.Ext.api.parameters.operation) that will be added by this PR. The sample of the document is here sample_event.jsonRelease Target
8.16
For mapping changes:
makeafter making the schema changes, and committed all changes