Skip to content

Commit f138afd

Browse files
amshamah419inbalapt1
amshamah419
authored and
inbalapt1
committed
Fix for list of techniques in InvestigationDetailedSummaryToTable (demisto#39291)
* fix for customer issue
1 parent 3595108 commit f138afd

File tree

6 files changed

+144
-23
lines changed

6 files changed

+144
-23
lines changed

‎Packs/MalwareInvestigationAndResponse/ReleaseNotes/2_0_17.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
#### Scripts
3+
4+
##### InvestigationDetailedSummaryToTable
5+
6+
- Updated the InvestigationDetailedSummaryToTable script to support a list of techniques.
7+
- Updated the Docker image to: *demisto/python3:3.12.8.1983910*.

‎Packs/MalwareInvestigationAndResponse/Scripts/InvestigationDetailedSummaryToTable/InvestigationDetailedSummaryToTable.py

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@ def table_command(context: dict) -> CommandResults:
1515
for tactic, techniques in context.items():
1616
table_values.append({TACTIC: f'**{tactic.upper()}**', STATUS: ''})
1717

18-
for technique, found in techniques.items():
19-
table_values.append({TACTIC: technique, STATUS: BOOL_TO_DESCRIPTION[found]})
20-
return CommandResults(readable_output=tableToMarkdown('', table_values, headers=[TACTIC, STATUS]))
18+
techniques_list = techniques if isinstance(techniques, list) else [techniques]
19+
for technique_dict in techniques_list:
20+
for technique, found in technique_dict.items():
21+
table_values.append({TACTIC: technique, STATUS: BOOL_TO_DESCRIPTION[found]})
22+
23+
readable_output = tableToMarkdown('', table_values, headers=[TACTIC, STATUS])
24+
return CommandResults(readable_output=readable_output)
2125

2226

2327
def main():

‎Packs/MalwareInvestigationAndResponse/Scripts/InvestigationDetailedSummaryToTable/InvestigationDetailedSummaryToTable.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ tags:
1212
timeout: '0'
1313
type: python
1414
subtype: python3
15-
dockerimage: demisto/python3:3.11.10.115186
15+
dockerimage: demisto/python3:3.12.8.1983910
1616
fromversion: 6.2.0
1717
tests:
1818
- No tests (auto formatted)

‎Packs/MalwareInvestigationAndResponse/Scripts/InvestigationDetailedSummaryToTable/InvestigationDetailedSummaryToTable_test.py

Lines changed: 118 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,123 @@ def test_empty_context():
2020

2121
def test_table_command():
2222
context = {
23-
"Defense Evasion": {
24-
"Deobfuscate/Decode Files or Information": True,
25-
"Indicator Removal on Host": False
26-
},
27-
"Execution": {
28-
"Command and Scripting Interpreter": True,
29-
"Command and Scripting Interpreter: PowerShell": True
30-
},
23+
"Collection": [
24+
{
25+
"Automated Collection": True,
26+
"Data Staged: Local Data Staging": True,
27+
"Data from Local System": True,
28+
"Email Collection": True,
29+
"Input Capture: Keylogging": True,
30+
"Screen Capture": True,
31+
}
32+
],
33+
"Command & Control": [
34+
{
35+
"Application Layer Protocol": True,
36+
"Encrypted Channel": True,
37+
"Encrypted Channel: Asymmetric Cryptography": True,
38+
"Encrypted Channel: Symmetric Cryptography": True,
39+
"Ingress Tool Transfer": True,
40+
"Non-Application Layer Protocol": True,
41+
"Proxy": True,
42+
}
43+
],
44+
"Credential Access": [
45+
{"Credentials from Password Stores": True, "Input Capture: Keylogging": True}
46+
],
47+
"Defense Evasion": [
48+
{
49+
"Abuse Elevation Control Mechanism: Bypass User Account Control": True,
50+
"Access Token Manipulation": True,
51+
"Access Token Manipulation: Token Impersonation/Theft": True,
52+
"Debugger Evasion": True,
53+
"Deobfuscate/Decode Files or Information": True,
54+
"Execution Guardrails": True,
55+
"File and Directory Permissions Modification": True,
56+
"Hide Artifacts": True,
57+
"Hijack Execution Flow: Hijack Execution Flow": True,
58+
"Impair Defenses: Disable or Modify Tools": True,
59+
"Indicator Removal: Clear Command History": True,
60+
"Indicator Removal: Indicator Removal": True,
61+
"Masquerading": True,
62+
"Modify Registry": True,
63+
"Obfuscated Files or Information": True,
64+
"Obfuscated Files or Information: Embedded Payloads": True,
65+
"Obfuscated Files or Information: Obfuscated Files or Information": True,
66+
"Process Injection": True,
67+
"Process Injection: Asynchronous Procedure Call": True,
68+
"Process Injection: Dynamic-link Library Injection": True,
69+
"Process Injection: Extra Window Memory Injection": True,
70+
"Process Injection: Thread Execution Hijacking": True,
71+
"Reflective Code Loading": True,
72+
"Virtualization/Sandbox Evasion: System Checks": True,
73+
"Virtualization/Sandbox Evasion: Time Based Evasion": True,
74+
}
75+
],
76+
"Discovery": [
77+
{
78+
"Account Discovery": True,
79+
"Application Window Discovery": True,
80+
"Debugger Evasion": True,
81+
"File and Directory Discovery": True,
82+
"Process Discovery": True,
83+
"Query Registry": True,
84+
"Remote System Discovery": True,
85+
"System Information Discovery": True,
86+
"System Location Discovery": True,
87+
"System Location Discovery: System Language Discovery": True,
88+
"System Owner/User Discovery": True,
89+
"System Service Discovery": True,
90+
"System Time Discovery": True,
91+
"Virtualization/Sandbox Evasion: System Checks": True,
92+
"Virtualization/Sandbox Evasion: Time Based Evasion": True,
93+
}
94+
],
95+
"Execution": [
96+
{
97+
"Command and Scripting Interpreter": False,
98+
"Command and Scripting Interpreter: PowerShell": True,
99+
"Inter-Process Communication": True,
100+
"Native API": True,
101+
"Shared Modules": True,
102+
"System Services: System Services": True,
103+
}
104+
],
105+
"Exfiltration": [{"Scheduled Transfer": True}],
106+
"Impact": [
107+
{
108+
"Data Encrypted for Impact": True,
109+
"Data Manipulation": True,
110+
"Service Stop": True,
111+
"System Shutdown/Reboot": True,
112+
}
113+
],
114+
"Lateral Movement": [{"Lateral Tool Transfer": True, "Remote Services": False}],
115+
"Persistence": [
116+
{
117+
"Boot or Logon Autostart Execution": True,
118+
"Create or Modify System Process": True,
119+
"Create or Modify System Process: Windows Service": True,
120+
"Event Triggered Execution: Event Triggered Execution": True,
121+
"Hijack Execution Flow: Hijack Execution Flow": True,
122+
}
123+
],
124+
"Privilege Escalation": [
125+
{
126+
"Abuse Elevation Control Mechanism: Bypass User Account Control": True,
127+
"Access Token Manipulation": True,
128+
"Access Token Manipulation: Token Impersonation/Theft": True,
129+
"Boot or Logon Autostart Execution": True,
130+
"Create or Modify System Process": True,
131+
"Create or Modify System Process: Windows Service": True,
132+
"Event Triggered Execution: Event Triggered Execution": True,
133+
"Hijack Execution Flow: Hijack Execution Flow": True,
134+
"Process Injection": True,
135+
"Process Injection: Asynchronous Procedure Call": True,
136+
"Process Injection: Dynamic-link Library Injection": True,
137+
"Process Injection: Extra Window Memory Injection": True,
138+
"Process Injection: Thread Execution Hijacking": True,
139+
}
140+
],
31141
}
32142
assert table_command(context).to_context() == _load_test_file('table_command.json')

‎Packs/MalwareInvestigationAndResponse/Scripts/InvestigationDetailedSummaryToTable/test_data/table_command.json

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"Type": 1,
3-
"ContentsFormat": "json",
4-
"Contents": null,
5-
"HumanReadable": "|Tactic|Status|\n|---|---|\n| **DEFENSE EVASION** | |\n| Deobfuscate/Decode Files or Information | \ud83d\udd34 Detected |\n| Indicator Removal on Host | \ud83d\udfe2 Not Detected |\n| **EXECUTION** | |\n| Command and Scripting Interpreter | \ud83d\udd34 Detected |\n| Command and Scripting Interpreter: PowerShell | \ud83d\udd34 Detected |\n",
6-
"EntryContext": {},
7-
"IndicatorTimeline": [],
8-
"IgnoreAutoExtract": false,
9-
"Note": false,
10-
"Relationships": []
11-
}
2+
"Type": 1,
3+
"ContentsFormat": "json",
4+
"Contents": null,
5+
"HumanReadable": "|Tactic|Status|\n|---|---|\n| **COLLECTION** | |\n| Automated Collection | 🔴 Detected |\n| Data Staged: Local Data Staging | 🔴 Detected |\n| Data from Local System | 🔴 Detected |\n| Email Collection | 🔴 Detected |\n| Input Capture: Keylogging | 🔴 Detected |\n| Screen Capture | 🔴 Detected |\n| **COMMAND & CONTROL** | |\n| Application Layer Protocol | 🔴 Detected |\n| Encrypted Channel | 🔴 Detected |\n| Encrypted Channel: Asymmetric Cryptography | 🔴 Detected |\n| Encrypted Channel: Symmetric Cryptography | 🔴 Detected |\n| Ingress Tool Transfer | 🔴 Detected |\n| Non-Application Layer Protocol | 🔴 Detected |\n| Proxy | 🔴 Detected |\n| **CREDENTIAL ACCESS** | |\n| Credentials from Password Stores | 🔴 Detected |\n| Input Capture: Keylogging | 🔴 Detected |\n| **DEFENSE EVASION** | |\n| Abuse Elevation Control Mechanism: Bypass User Account Control | 🔴 Detected |\n| Access Token Manipulation | 🔴 Detected |\n| Access Token Manipulation: Token Impersonation/Theft | 🔴 Detected |\n| Debugger Evasion | 🔴 Detected |\n| Deobfuscate/Decode Files or Information | 🔴 Detected |\n| Execution Guardrails | 🔴 Detected |\n| File and Directory Permissions Modification | 🔴 Detected |\n| Hide Artifacts | 🔴 Detected |\n| Hijack Execution Flow: Hijack Execution Flow | 🔴 Detected |\n| Impair Defenses: Disable or Modify Tools | 🔴 Detected |\n| Indicator Removal: Clear Command History | 🔴 Detected |\n| Indicator Removal: Indicator Removal | 🔴 Detected |\n| Masquerading | 🔴 Detected |\n| Modify Registry | 🔴 Detected |\n| Obfuscated Files or Information | 🔴 Detected |\n| Obfuscated Files or Information: Embedded Payloads | 🔴 Detected |\n| Obfuscated Files or Information: Obfuscated Files or Information | 🔴 Detected |\n| Process Injection | 🔴 Detected |\n| Process Injection: Asynchronous Procedure Call | 🔴 Detected |\n| Process Injection: Dynamic-link Library Injection | 🔴 Detected |\n| Process Injection: Extra Window Memory Injection | 🔴 Detected |\n| Process Injection: Thread Execution Hijacking | 🔴 Detected |\n| Reflective Code Loading | 🔴 Detected |\n| Virtualization/Sandbox Evasion: System Checks | 🔴 Detected |\n| Virtualization/Sandbox Evasion: Time Based Evasion | 🔴 Detected |\n| **DISCOVERY** | |\n| Account Discovery | 🔴 Detected |\n| Application Window Discovery | 🔴 Detected |\n| Debugger Evasion | 🔴 Detected |\n| File and Directory Discovery | 🔴 Detected |\n| Process Discovery | 🔴 Detected |\n| Query Registry | 🔴 Detected |\n| Remote System Discovery | 🔴 Detected |\n| System Information Discovery | 🔴 Detected |\n| System Location Discovery | 🔴 Detected |\n| System Location Discovery: System Language Discovery | 🔴 Detected |\n| System Owner/User Discovery | 🔴 Detected |\n| System Service Discovery | 🔴 Detected |\n| System Time Discovery | 🔴 Detected |\n| Virtualization/Sandbox Evasion: System Checks | 🔴 Detected |\n| Virtualization/Sandbox Evasion: Time Based Evasion | 🔴 Detected |\n| **EXECUTION** | |\n| Command and Scripting Interpreter | 🟢 Not Detected |\n| Command and Scripting Interpreter: PowerShell | 🔴 Detected |\n| Inter-Process Communication | 🔴 Detected |\n| Native API | 🔴 Detected |\n| Shared Modules | 🔴 Detected |\n| System Services: System Services | 🔴 Detected |\n| **EXFILTRATION** | |\n| Scheduled Transfer | 🔴 Detected |\n| **IMPACT** | |\n| Data Encrypted for Impact | 🔴 Detected |\n| Data Manipulation | 🔴 Detected |\n| Service Stop | 🔴 Detected |\n| System Shutdown/Reboot | 🔴 Detected |\n| **LATERAL MOVEMENT** | |\n| Lateral Tool Transfer | 🔴 Detected |\n| Remote Services | 🟢 Not Detected |\n| **PERSISTENCE** | |\n| Boot or Logon Autostart Execution | 🔴 Detected |\n| Create or Modify System Process | 🔴 Detected |\n| Create or Modify System Process: Windows Service | 🔴 Detected |\n| Event Triggered Execution: Event Triggered Execution | 🔴 Detected |\n| Hijack Execution Flow: Hijack Execution Flow | 🔴 Detected |\n| **PRIVILEGE ESCALATION** | |\n| Abuse Elevation Control Mechanism: Bypass User Account Control | 🔴 Detected |\n| Access Token Manipulation | 🔴 Detected |\n| Access Token Manipulation: Token Impersonation/Theft | 🔴 Detected |\n| Boot or Logon Autostart Execution | 🔴 Detected |\n| Create or Modify System Process | 🔴 Detected |\n| Create or Modify System Process: Windows Service | 🔴 Detected |\n| Event Triggered Execution: Event Triggered Execution | 🔴 Detected |\n| Hijack Execution Flow: Hijack Execution Flow | 🔴 Detected |\n| Process Injection | 🔴 Detected |\n| Process Injection: Asynchronous Procedure Call | 🔴 Detected |\n| Process Injection: Dynamic-link Library Injection | 🔴 Detected |\n| Process Injection: Extra Window Memory Injection | 🔴 Detected |\n| Process Injection: Thread Execution Hijacking | 🔴 Detected |\n",
6+
"EntryContext": {},
7+
"IndicatorTimeline": [],
8+
"IgnoreAutoExtract": false,
9+
"Note": false,
10+
"Relationships": []
11+
}

‎Packs/MalwareInvestigationAndResponse/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"videos": [
66
"https://www.youtube.com/watch?v=DtGIefyoTao"
77
],
8-
"currentVersion": "2.0.16",
8+
"currentVersion": "2.0.17",
99
"serverMinVersion": "6.5.0",
1010
"author": "Cortex XSOAR",
1111
"hidden": false,

0 commit comments

Comments
 (0)