Skip to content

Commit c80e649

Browse files
nicpenningnicpenning
committed
Add windows_defender.evidence paths for multiple hits, add anotehr test case, generate new expected and README
1 parent 0eb4f90 commit c80e649

File tree

6 files changed

+254
-18
lines changed

6 files changed

+254
-18
lines changed

‎packages/windows/data_stream/windows_defender/_dev/test/pipeline/test-events-windows-defender-events.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,78 @@
11
{
22
"events": [
3+
{
4+
"@timestamp": "2024-06-21T01:21:15.1310609Z",
5+
"event": {
6+
"code": "1116",
7+
"kind": "event",
8+
"provider": "Microsoft-Windows-Windows Defender"
9+
},
10+
"host": {
11+
"name": "el33t-b00k-1"
12+
},
13+
"log": {
14+
"level": "Warning"
15+
},
16+
"message": "Microsoft Defender Antivirus has detected malware or other potentially unwanted software.\r\n For more information please see the following:\r\nhttps://go.microsoft.com/fwlink/?linkid=37020\u0026name=Virus:DOS/EICAR_Test_File\u0026threatid=2147519003\u0026enterprise=0\r\n \tName: Virus:DOS/EICAR_Test_File\r\n \tID: 2147519003\r\n \tSeverity: Severe\r\n \tCategory: Virus\r\n \tPath: file:_C:\\Users\\topsy\\OneDrive\\Desktop\\eat_more_yams.exe\r\n \tDetection Origin: Local machine\r\n \tDetection Type: Concrete\r\n \tDetection Source: Real-Time Protection\r\n \tUser: el33t-b00k-1\\topsy\r\n \tProcess Name: C:\\Users\\topsy\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\r\n \tSecurity intelligence Version: AV: 1.413.419.0, AS: 1.413.419.0, NIS: 1.413.419.0\r\n \tEngine Version: AM: 1.1.24050.5, NIS: 1.1.24050.5",
17+
"winlog": {
18+
"activity_id": "5f4a9fb7-8bb9-4d46-a5af-b880cefca3c1",
19+
"channel": "Microsoft-Windows-Windows Defender/Operational",
20+
"computer_name": "el33t-b00k-1",
21+
"event_data": {
22+
"Detection_User": "NT AUTHORITY\\SYSTEM",
23+
"Execution_Name": "Suspended",
24+
"Detection_Time": "2024-09-26T16:04:49.772Z",
25+
"Error_Description": "The operation completed successfully. ",
26+
"Error_Code": "0x00000000",
27+
"Action_Name": "Not Applicable",
28+
"FWLink": "https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=1",
29+
"Post_Clean_Status": "0",
30+
"Category_ID": "42",
31+
"Additional_Actions_String": "No additional actions required",
32+
"Additional_Actions_ID": "0",
33+
"Pre_Execution_Status": "0",
34+
"Security_intelligence_Version": "AV: 1.419.183.0, AS: 1.419.183.0, NIS: 1.419.183.0",
35+
"Threat_ID": "2147519003",
36+
"Detection_ID": "{21A294A2-FE84-4DE0-B1D0-47D6DCD4DA9A}",
37+
"Path": "file:_D:\\autorun.inf\\autorun.inf.exe; file:_D:\\autorun.inf\\Protection for Autorun\\Protection for Autorun.exe; file:_D:\\test\\.exe",
38+
"Source_Name": "System",
39+
"Origin_ID": "1",
40+
"Type_Name": "Concrete",
41+
"Action_ID": "9",
42+
"Source_ID": "2",
43+
"Product_Name": "Microsoft Defender Antivirus",
44+
"Category_Name": "Virus",
45+
"Status_Code": "1",
46+
"Threat_Name": "Virus:DOS/EICAR_Test_File",
47+
"Origin_Name": "Local machine",
48+
"Severity_ID": "5",
49+
"State": "1",
50+
"Severity_Name": "Severe",
51+
"Execution_ID": "1",
52+
"Product_Version": "4.18.24080.9",
53+
"Engine_Version": "AM: 1.1.24080.9, NIS: 1.1.24080.9",
54+
"Type_ID": "0"
55+
},
56+
"event_id": "1116",
57+
"level": "Warning",
58+
"opcode": "Info",
59+
"process": {
60+
"pid": 7676,
61+
"thread": {
62+
"id": 29468
63+
}
64+
},
65+
"provider_guid": "11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78",
66+
"provider_name": "Microsoft-Windows-Windows Defender",
67+
"record_id": "5646",
68+
"time_created": "2024-06-21T01:21:15.1310609Z",
69+
"user": {
70+
"identifier": "S-1-5-18",
71+
"name": "Topsy"
72+
},
73+
"version": 0
74+
}
75+
},
376
{
477
"@timestamp": "2024-06-21T01:21:15.1310609Z",
578
"event": {

‎packages/windows/data_stream/windows_defender/_dev/test/pipeline/test-events-windows-defender-events.json-expected.json‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,106 @@
11
{
22
"expected": [
3+
{
4+
"@timestamp": "2024-06-21T01:21:15.131Z",
5+
"ecs": {
6+
"version": "8.11.0"
7+
},
8+
"event": {
9+
"action": "malware-detected",
10+
"category": [
11+
"malware"
12+
],
13+
"code": "1116",
14+
"kind": "event",
15+
"outcome": "success",
16+
"provider": "Microsoft-Windows-Windows Defender",
17+
"reference": "https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=1",
18+
"type": [
19+
"info"
20+
]
21+
},
22+
"file": {
23+
"extension": "inf.exe",
24+
"name": "autorun.inf.exe",
25+
"path": "D:\\autorun.inf\\autorun.inf.exe"
26+
},
27+
"host": {
28+
"name": "el33t-b00k-1"
29+
},
30+
"log": {
31+
"level": "Warning"
32+
},
33+
"message": "Microsoft Defender Antivirus has detected malware or other potentially unwanted software.\r\n For more information please see the following:\r\nhttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0\r\n \tName: Virus:DOS/EICAR_Test_File\r\n \tID: 2147519003\r\n \tSeverity: Severe\r\n \tCategory: Virus\r\n \tPath: file:_C:\\Users\\topsy\\OneDrive\\Desktop\\eat_more_yams.exe\r\n \tDetection Origin: Local machine\r\n \tDetection Type: Concrete\r\n \tDetection Source: Real-Time Protection\r\n \tUser: el33t-b00k-1\\topsy\r\n \tProcess Name: C:\\Users\\topsy\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\r\n \tSecurity intelligence Version: AV: 1.413.419.0, AS: 1.413.419.0, NIS: 1.413.419.0\r\n \tEngine Version: AM: 1.1.24050.5, NIS: 1.1.24050.5",
34+
"user": {
35+
"domain": "NT AUTHORITY",
36+
"name": "SYSTEM"
37+
},
38+
"windows_defender": {
39+
"evidence_paths": [
40+
"D:\\autorun.inf\\autorun.inf.exe",
41+
"D:\\autorun.inf\\Protection for Autorun\\Protection for Autorun.exe",
42+
"D:\\test\\.exe"
43+
]
44+
},
45+
"winlog": {
46+
"activity_id": "5f4a9fb7-8bb9-4d46-a5af-b880cefca3c1",
47+
"channel": "Microsoft-Windows-Windows Defender/Operational",
48+
"computer_name": "el33t-b00k-1",
49+
"event_data": {
50+
"Action_ID": "9",
51+
"Action_Name": "Not Applicable",
52+
"Additional_Actions_ID": "0",
53+
"Additional_Actions_String": "No additional actions required",
54+
"Category_ID": "42",
55+
"Category_Name": "Virus",
56+
"Detection_ID": "{21A294A2-FE84-4DE0-B1D0-47D6DCD4DA9A}",
57+
"Detection_Time": "2024-09-26T16:04:49.772Z",
58+
"Detection_User": "NT AUTHORITY\\SYSTEM",
59+
"Engine_Version": "AM: 1.1.24080.9, NIS: 1.1.24080.9",
60+
"Error_Code": "0x00000000",
61+
"Error_Description": "The operation completed successfully. ",
62+
"Execution_ID": "1",
63+
"Execution_Name": "Suspended",
64+
"FWLink": "https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=1",
65+
"Origin_ID": "1",
66+
"Origin_Name": "Local machine",
67+
"Path": "file:_D:\\autorun.inf\\autorun.inf.exe; file:_D:\\autorun.inf\\Protection for Autorun\\Protection for Autorun.exe; file:_D:\\test\\.exe",
68+
"Post_Clean_Status": "0",
69+
"Pre_Execution_Status": "0",
70+
"Product_Name": "Microsoft Defender Antivirus",
71+
"Product_Version": "4.18.24080.9",
72+
"Security_intelligence_Version": "AV: 1.419.183.0, AS: 1.419.183.0, NIS: 1.419.183.0",
73+
"Severity_ID": "5",
74+
"Severity_Name": "Severe",
75+
"Source_ID": "2",
76+
"Source_Name": "System",
77+
"State": "1",
78+
"Status_Code": "1",
79+
"Threat_ID": "2147519003",
80+
"Threat_Name": "Virus:DOS/EICAR_Test_File",
81+
"Type_ID": "0",
82+
"Type_Name": "Concrete"
83+
},
84+
"event_id": "1116",
85+
"level": "Warning",
86+
"opcode": "Info",
87+
"process": {
88+
"pid": 7676,
89+
"thread": {
90+
"id": 29468
91+
}
92+
},
93+
"provider_guid": "11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78",
94+
"provider_name": "Microsoft-Windows-Windows Defender",
95+
"record_id": "5646",
96+
"time_created": "2024-06-21T01:21:15.1310609Z",
97+
"user": {
98+
"identifier": "S-1-5-18",
99+
"name": "Topsy"
100+
},
101+
"version": 0
102+
}
103+
},
3104
{
4105
"@timestamp": "2024-06-21T01:21:15.131Z",
5106
"ecs": {
@@ -35,6 +136,11 @@
35136
"domain": "NT AUTHORITY",
36137
"name": "SYSTEM"
37138
},
139+
"windows_defender": {
140+
"evidence_paths": [
141+
"C:\\Users\\Topsy\\Desktop\\eat_more_yams.exe"
142+
]
143+
},
38144
"winlog": {
39145
"activity_id": "5f4a9fb7-8bb9-4d46-a5af-b880cefca3c1",
40146
"channel": "Microsoft-Windows-Windows Defender/Operational",
@@ -129,6 +235,12 @@
129235
"domain": "NT AUTHORITY",
130236
"name": "SYSTEM"
131237
},
238+
"windows_defender": {
239+
"evidence_paths": [
240+
"C:\\Users\\Topsy\\Desktop\\eat_more_yams.exe",
241+
"pid: 31337"
242+
]
243+
},
132244
"winlog": {
133245
"activity_id": "5f4a9fb7-8bb9-4d46-a5af-b880cefca3c1",
134246
"channel": "Microsoft-Windows-Windows Defender/Operational",
@@ -459,6 +571,11 @@
459571
"domain": "NT AUTHORITY",
460572
"name": "SYSTEM"
461573
},
574+
"windows_defender": {
575+
"evidence_paths": [
576+
"C:\\Users\\Topsy\\Desktop\\eat_more_yams.exe"
577+
]
578+
},
462579
"winlog": {
463580
"activity_id": "",
464581
"channel": "Microsoft-Windows-Windows Defender/Operational",
@@ -554,6 +671,12 @@
554671
"domain": "NT AUTHORITY",
555672
"name": "SYSTEM"
556673
},
674+
"windows_defender": {
675+
"evidence_paths": [
676+
"C:\\Users\\Topsy\\Desktop\\eat_more_yams.exe",
677+
"pid: 1337"
678+
]
679+
},
557680
"winlog": {
558681
"activity_id": "",
559682
"channel": "Microsoft-Windows-Windows Defender/Operational",

‎packages/windows/data_stream/windows_defender/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,28 @@ processors:
162162
patterns:
163163
- "file:_(?<file.path>[^;]+)(; process:_pid:%{NUMBER:process.pid})?"
164164
ignore_missing: true
165+
- split:
166+
field: winlog.event_data.Path
167+
separator: ";"
168+
target_field: windows_defender.evidence_paths
169+
ignore_missing: true
170+
ignore_failure: true
171+
- trim:
172+
field: windows_defender.evidence_paths
173+
ignore_missing: true
174+
ignore_failure: true
175+
- gsub:
176+
field: windows_defender.evidence_paths
177+
pattern: "file:_"
178+
replacement: ""
179+
ignore_missing: true
180+
ignore_failure: true
181+
- gsub:
182+
field: windows_defender.evidence_paths
183+
pattern: "process:_"
184+
replacement: ""
185+
ignore_missing: true
186+
ignore_failure: true
165187
- grok:
166188
field: winlog.event_data.FileName
167189
patterns:

‎packages/windows/data_stream/windows_defender/fields/fields.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
- name: windows_defender
2+
type: group
3+
description: All custom fields that are specific to a Windows Defender event will be grouped in this field name.
4+
fields:
5+
- name: evidence_paths
6+
type: keyword
7+
description: One or more paths found in the event.

‎packages/windows/data_stream/windows_defender/sample_event.json‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
{
22
"@timestamp": "2024-09-25T19:30:20.339Z",
33
"agent": {
4-
"ephemeral_id": "d0fee858-3b2f-4e5d-9fbb-204845903e8a",
5-
"id": "757d65b4-4801-45c8-ad21-82958af8fd34",
6-
"name": "elastic-agent-80630",
4+
"ephemeral_id": "e9af23ec-c024-4b56-a624-39e242319c16",
5+
"id": "4a0bc7fa-6bfd-41c2-9cb6-17a1560abba7",
6+
"name": "elastic-agent-41982",
77
"type": "filebeat",
8-
"version": "8.15.3"
8+
"version": "8.15.2"
99
},
1010
"data_stream": {
1111
"dataset": "windows.windows_defender",
12-
"namespace": "71160",
12+
"namespace": "97455",
1313
"type": "logs"
1414
},
1515
"ecs": {
1616
"version": "8.11.0"
1717
},
1818
"elastic_agent": {
19-
"id": "757d65b4-4801-45c8-ad21-82958af8fd34",
19+
"id": "4a0bc7fa-6bfd-41c2-9cb6-17a1560abba7",
2020
"snapshot": false,
21-
"version": "8.15.3"
21+
"version": "8.15.2"
2222
},
2323
"event": {
2424
"action": "malware-quarantined",
@@ -27,9 +27,9 @@
2727
"malware"
2828
],
2929
"code": "1117",
30-
"created": "2024-10-27T18:11:49.634Z",
30+
"created": "2024-11-04T23:00:42.213Z",
3131
"dataset": "windows.windows_defender",
32-
"ingested": "2024-10-27T18:11:52Z",
32+
"ingested": "2024-11-04T23:00:45Z",
3333
"kind": "event",
3434
"original": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1117</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2024-09-25T19:30:20.3397185Z'/><EventRecordID>22399</EventRecordID><Correlation ActivityID='{e8e94442-2856-4bab-a775-454654f7ec59}'/><Execution ProcessID='3168' ThreadID='13904'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>el33t-b00k-1.org.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.24080.9</Data><Data Name='Detection ID'>{4E4D1D41-19CC-4EE2-BDB0-950A07B81378}</Data><Data Name='Detection Time'>2024-09-25T19:29:38.198Z</Data><Data Name='Unused'></Data><Data Name='Unused2'></Data><Data Name='Threat ID'>2147680291</Data><Data Name='Threat Name'>Trojan:Win32/Detplock</Data><Data Name='Severity ID'>5</Data><Data Name='Severity Name'>Severe</Data><Data Name='Category ID'>8</Data><Data Name='Category Name'>Trojan</Data><Data Name='FWLink'>https://go.microsoft.com/fwlink/?linkid=37020&amp;name=Trojan:Win32/Detplock&amp;threatid=2147680291&amp;enterprise=1</Data><Data Name='Status Code'>3</Data><Data Name='Status Description'></Data><Data Name='State'>2</Data><Data Name='Source ID'>3</Data><Data Name='Source Name'>Real-Time Protection</Data><Data Name='Process Name'>C:\\Program Files\\Notepad++\\notepad++.exe</Data><Data Name='Detection User'>ORG\\Topsy</Data><Data Name='Unused3'></Data><Data Name='Path'>file:_C:\\Users\\Topsy\\Desktop\\eat_dem_yams.exe</Data><Data Name='Origin ID'>1</Data><Data Name='Origin Name'>Local machine</Data><Data Name='Execution ID'>1</Data><Data Name='Execution Name'>Suspended</Data><Data Name='Type ID'>8</Data><Data Name='Type Name'>FastPath</Data><Data Name='Pre Execution Status'>0</Data><Data Name='Action ID'>2</Data><Data Name='Action Name'>Quarantine</Data><Data Name='Unused4'></Data><Data Name='Error Code'>0x00000000</Data><Data Name='Error Description'>The operation completed successfully. </Data><Data Name='Unused5'></Data><Data Name='Post Clean Status'>0</Data><Data Name='Additional Actions ID'>0</Data><Data Name='Additional Actions String'>No additional actions required</Data><Data Name='Remediation User'>NT AUTHORITY\\SYSTEM</Data><Data Name='Unused6'></Data><Data Name='Security intelligence Version'>AV: 1.419.163.0, AS: 1.419.163.0, NIS: 1.419.163.0</Data><Data Name='Engine Version'>AM: 1.1.24080.9, NIS: 1.1.24080.9</Data></EventData><RenderingInfo Culture='en-US'><Message>Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.&#13;&#10; For more information please see the following:&#13;&#10;https://go.microsoft.com/fwlink/?linkid=37020&amp;name=Trojan:Win32/Detplock&amp;threatid=2147680291&amp;enterprise=1&#13;&#10; &#9;Name: Trojan:Win32/Detplock&#13;&#10; &#9;ID: 2147680291&#13;&#10; &#9;Severity: Severe&#13;&#10; &#9;Category: Trojan&#13;&#10; &#9;Path: file:_C:\\Users\\Topsy\\Desktop\\eat_dem_yams.exe&#13;&#10; &#9;Detection Origin: Local machine&#13;&#10; &#9;Detection Type: FastPath&#13;&#10; &#9;Detection Source: Real-Time Protection&#13;&#10; &#9;User: NT AUTHORITY\\SYSTEM&#13;&#10; &#9;Process Name: C:\\Program Files\\Notepad++\\notepad++.exe&#13;&#10; &#9;Action: Quarantine&#13;&#10; &#9;Action Status: No additional actions required&#13;&#10; &#9;Error Code: 0x00000000&#13;&#10; &#9;Error description: The operation completed successfully. &#13;&#10; &#9;Security intelligence Version: AV: 1.419.163.0, AS: 1.419.163.0, NIS: 1.419.163.0&#13;&#10; &#9;Engine Version: AM: 1.1.24080.9, NIS: 1.1.24080.9</Message><Level>Information</Level><Opcode>Info</Opcode><Provider>Microsoft-Windows-Windows Defender</Provider></RenderingInfo></Event>",
3535
"outcome": "success",
@@ -66,6 +66,11 @@
6666
"domain": "ORG",
6767
"name": "Topsy"
6868
},
69+
"windows_defender": {
70+
"evidence_paths": [
71+
"C:\\Users\\Topsy\\Desktop\\eat_dem_yams.exe"
72+
]
73+
},
6974
"winlog": {
7075
"activity_id": "{e8e94442-2856-4bab-a775-454654f7ec59}",
7176
"channel": "Microsoft-Windows-Windows Defender/Operational",

0 commit comments

Comments
 (0)