Skip to content

Commit 841d6f7

Browse files
nicpenningnicpenning
authored
[windows] Add Initial AppLocker Data Stream (EXE and DLL) (#6977)
1 parent 878927b commit 841d6f7

File tree

19 files changed

+1833
-2
lines changed

19 files changed

+1833
-2
lines changed

‎packages/windows/_dev/build/docs/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,15 @@ the events from Windows. The filter shown below is equivalent to
8282
8383
## Logs reference
8484
85+
### AppLocker/EXE and DLL
86+
87+
The Windows `applocker_exe_and_dll` data stream provides events from the Windows
88+
`Microsoft-Windows-AppLocker/EXE and DLL` event log.
89+
90+
{{event "applocker_exe_and_dll"}}
91+
92+
{{fields "applocker_exe_and_dll"}}
93+
8594
### Forwarded
8695

8796
The Windows `forwarded` data stream provides events from the Windows

‎packages/windows/_dev/deploy/docker/files/config.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,3 +175,47 @@ rules:
175175
"splunk_server": "69819b6ce1bd"
176176
}
177177
}
178+
- path: /services/search/jobs/export
179+
user: test
180+
password: test
181+
methods:
182+
- post
183+
query_params:
184+
index_earliest: "{index_earliest:[0-9]+}"
185+
index_latest: "{index_latest:[0-9]+}"
186+
output_mode: json
187+
search: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" | streamstats max(_indextime) AS max_indextime'
188+
request_headers:
189+
Content-Type:
190+
- "application/x-www-form-urlencoded"
191+
responses:
192+
- status_code: 200
193+
headers:
194+
Content-Type:
195+
- "application/json"
196+
body: |-
197+
{
198+
"preview": false,
199+
"offset": 194,
200+
"lastrow": true,
201+
"result": {
202+
"_bkt": "main~0~1212176D-89E1-485D-89E6-3ADC276CCA38",
203+
"_cd": "0:315",
204+
"_indextime": "1622471463",
205+
"_raw": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}' /><EventID>8003</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-07-20T15:05:03.8826518Z' /><EventRecordID>154247</EventRecordID><Correlation /><Execution ProcessID='33848' ThreadID='12040' /><Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel><Computer>TOPSYLL.local</Computer><Security UserID='S-1-5-21-1133191089-1850170202-1535859923-200319' /></System><UserData><RuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'><PolicyNameLength>3</PolicyNameLength><PolicyName>EXE</PolicyName><RuleId>{00000000-0000-0000-0000-000000000000}</RuleId><RuleNameLength>1</RuleNameLength><RuleName>-</RuleName><RuleSddlLength>1</RuleSddlLength><RuleSddl>-</RuleSddl><TargetUser>S-1-5-21-1133191089-1850170202-1535859923-200319</TargetUser><TargetProcessId>27116</TargetProcessId><FilePathLength>101</FilePathLength><FilePath>%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE</FilePath><FileHashLength>32</FileHashLength><FileHash>11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5</FileHash><FqbnLength>72</FqbnLength><Fqbn>O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01</Fqbn><TargetLogonId>0x14fcb7</TargetLogonId><FullFilePathLength>94</FullFilePathLength><FullFilePath>C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe</FullFilePath></RuleAndFileData></UserData></Event>",
206+
"_serial": "194",
207+
"_si": [
208+
"69819b6ce1bd",
209+
"main"
210+
],
211+
"_sourcetype": "XmlWinEventLog:Security",
212+
"_time": "2021-05-25 13:11:45.000 UTC",
213+
"host": "VAGRANT",
214+
"index": "main",
215+
"linecount": "1",
216+
"max_indextime": "1622471606",
217+
"source": "WinEventLog:Security",
218+
"sourcetype": "XmlWinEventLog:Security",
219+
"splunk_server": "69819b6ce1bd"
220+
}
221+
}

‎packages/windows/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.27.0"
3+
changes:
4+
- description: Adding initial Windows AppLocker data stream [beta]
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/6977
27
- version: "1.26.0"
38
changes:
49
- description: Set `event.action` to sysmon name in sysmon_operational.

‎packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2023-07-20T15:05:03.8826518Z",
5+
"event": {
6+
"code": 8003,
7+
"kind": "event",
8+
"provider": "Microsoft-Windows-AppLocker"
9+
},
10+
"host": {
11+
"name": "TOPSYLL.local"
12+
},
13+
"log": {
14+
"level": "Warning"
15+
},
16+
"message": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.",
17+
"winlog": {
18+
"channel": "Microsoft-Windows-AppLocker/EXE and DLL",
19+
"computer_name": "TOPSYLL.local",
20+
"user_data": {
21+
"PolicyNameLength": 3,
22+
"PolicyName": "EXE",
23+
"RuleId": "00000000-0000-0000-0000-000000000000",
24+
"RuleNameLength": 1,
25+
"RuleName": "-",
26+
"RuleSddlLength": 1,
27+
"RuleSddl": "-",
28+
"TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319",
29+
"TargetProcessId": 27116,
30+
"FilePathLength": 101,
31+
"FilePath": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE",
32+
"FileHashLength": 32,
33+
"FileHash": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5",
34+
"FqbnLength": 72,
35+
"Fqbn": "O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01",
36+
"TargetLogonId": "0x14FCB7",
37+
"FullFilePathLength": 94,
38+
"FullFilePath": "C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe"
39+
},
40+
"event_id": "8003",
41+
"level": "Warning",
42+
"opcode": "Info\u0000",
43+
"process": {
44+
"pid": 33848,
45+
"thread": {
46+
"id": 12040
47+
}
48+
},
49+
"provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22",
50+
"provider_name": "Microsoft-Windows-AppLocker",
51+
"record_id": 154247,
52+
"time_created": "2023-07-20T15:05:03.8826518Z",
53+
"user": {
54+
"identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319"
55+
},
56+
"version": 0
57+
}
58+
}
59+
]
60+
}

‎packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json-expected.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2023-07-20T15:05:03.882Z",
5+
"ecs": {
6+
"version": "8.0.0"
7+
},
8+
"event": {
9+
"category": "process",
10+
"code": "8003",
11+
"kind": "event",
12+
"provider": "Microsoft-Windows-AppLocker",
13+
"type": "start"
14+
},
15+
"host": {
16+
"name": "TOPSYLL.local"
17+
},
18+
"log": {
19+
"level": "Warning"
20+
},
21+
"message": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.",
22+
"user": {
23+
"id": "S-1-5-21-1133191089-1850170202-1535859923-200319"
24+
},
25+
"winlog": {
26+
"channel": "Microsoft-Windows-AppLocker/EXE and DLL",
27+
"computer_name": "TOPSYLL.local",
28+
"event_id": "8003",
29+
"level": "Warning",
30+
"opcode": "Info\u0000",
31+
"process": {
32+
"pid": 33848,
33+
"thread": {
34+
"id": 12040
35+
}
36+
},
37+
"provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22",
38+
"provider_name": "Microsoft-Windows-AppLocker",
39+
"record_id": "154247",
40+
"time_created": "2023-07-20T15:05:03.8826518Z",
41+
"user": {
42+
"identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319"
43+
},
44+
"user_data": {
45+
"FileHash": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5",
46+
"FileHashLength": 32,
47+
"FilePath": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE",
48+
"FilePathLength": 101,
49+
"Fqbn": "O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01",
50+
"FqbnLength": 72,
51+
"FullFilePath": "C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe",
52+
"FullFilePathLength": 94,
53+
"PolicyName": "EXE",
54+
"PolicyNameLength": 3,
55+
"RuleId": "00000000-0000-0000-0000-000000000000",
56+
"RuleName": "-",
57+
"RuleNameLength": 1,
58+
"RuleSddl": "-",
59+
"RuleSddlLength": 1,
60+
"TargetLogonId": "0x14FCB7",
61+
"TargetProcessId": 27116,
62+
"TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319"
63+
},
64+
"version": 0
65+
}
66+
}
67+
]
68+
}

‎packages/windows/data_stream/applocker_exe_and_dll/_dev/test/system/test-default-config.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
input: httpjson
2+
service: splunk-mock
3+
vars:
4+
url: http://{{Hostname}}:{{Port}}
5+
username: test
6+
password: test
7+
enable_request_tracer: true
8+
data_stream:
9+
vars:
10+
preserve_original_event: true

‎packages/windows/data_stream/applocker_exe_and_dll/agent/stream/httpjson.yml.hbs‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
config_version: "2"
2+
interval: {{interval}}
3+
{{#if enable_request_tracer}}
4+
request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson"
5+
{{/if}}
6+
{{#unless token}}
7+
{{#if username}}
8+
{{#if password}}
9+
auth.basic.user: {{username}}
10+
auth.basic.password: {{password}}
11+
{{/if}}
12+
{{/if}}
13+
{{/unless}}
14+
cursor:
15+
index_earliest:
16+
value: '[[.last_event.result.max_indextime]]'
17+
request.url: {{url}}/services/search/jobs/export
18+
{{#if ssl}}
19+
request.ssl: {{ssl}}
20+
{{/if}}
21+
request.method: POST
22+
request.transforms:
23+
- set:
24+
target: url.params.search
25+
value: |-
26+
{{search}} | streamstats max(_indextime) AS max_indextime
27+
- set:
28+
target: url.params.output_mode
29+
value: "json"
30+
- set:
31+
target: url.params.index_earliest
32+
value: '[[ .cursor.index_earliest ]]'
33+
default: '[[(now (parseDuration "-{{interval}}")).Unix]]'
34+
- set:
35+
target: url.params.index_latest
36+
value: '[[(now).Unix]]'
37+
- set:
38+
target: header.Content-Type
39+
value: application/x-www-form-urlencoded
40+
{{#unless username}}
41+
{{#unless password}}
42+
{{#if token}}
43+
- set:
44+
target: header.Authorization
45+
value: {{token}}
46+
{{/if}}
47+
{{/unless}}
48+
{{/unless}}
49+
response.decode_as: application/x-ndjson
50+
{{#if tags.length}}
51+
tags:
52+
{{else if preserve_original_event}}
53+
tags:
54+
{{/if}}
55+
{{#each tags as |tag|}}
56+
- {{tag}}
57+
{{/each}}
58+
{{#if preserve_original_event}}
59+
- preserve_original_event
60+
{{/if}}
61+
{{#contains "forwarded" tags}}
62+
publisher_pipeline.disable_host: true
63+
{{/contains}}
64+
processors:
65+
- decode_json_fields:
66+
fields: message
67+
target: json
68+
add_error_key: true
69+
- drop_event:
70+
when:
71+
not:
72+
has_fields: ['json.result']
73+
- fingerprint:
74+
fields:
75+
- json.result._cd
76+
- json.result._indextime
77+
- json.result._raw
78+
- json.result._time
79+
- json.result.host
80+
- json.result.source
81+
target_field: "@metadata._id"
82+
- drop_fields:
83+
fields: message
84+
- rename:
85+
fields:
86+
- from: json.result._raw
87+
to: event.original
88+
- from: json.result.host
89+
to: host.name
90+
- from: json.result.source
91+
to: event.provider
92+
ignore_missing: true
93+
fail_on_error: false
94+
- drop_fields:
95+
fields: json
96+
- decode_xml_wineventlog:
97+
field: event.original
98+
target_field: winlog
99+
ignore_missing: true
100+
ignore_failure: true
101+
map_ecs_fields: true
102+
{{#if processors.length}}
103+
{{processors}}
104+
{{/if}}

‎packages/windows/data_stream/applocker_exe_and_dll/agent/stream/winlog.yml.hbs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Microsoft-Windows-AppLocker/EXE and DLL
2+
condition: ${host.platform} == 'windows'
3+
{{#if event_id}}
4+
event_id: {{event_id}}
5+
{{/if}}
6+
{{#if ignore_older}}
7+
ignore_older: {{ignore_older}}
8+
{{/if}}
9+
{{#if language}}
10+
language: {{language}}
11+
{{/if}}
12+
{{#if tags.length}}
13+
tags:
14+
{{#each tags as |tag|}}
15+
- {{tag}}
16+
{{/each}}
17+
{{/if}}
18+
{{#if preserve_original_event}}
19+
include_xml: true
20+
{{/if}}
21+
processors:
22+
- translate_sid:
23+
field: winlog.event_data.MemberSid
24+
account_name_target: winlog.event_data._MemberUserName
25+
domain_target: winlog.event_data._MemberDomain
26+
account_type_target: winlog.event_data._MemberAccountType
27+
ignore_missing: true
28+
ignore_failure: true
29+
{{#if processors.length}}
30+
{{processors}}
31+
{{/if}}

0 commit comments

Comments
 (0)