Добавил решение для Task 7 [OSW#2: Task-7]

packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_en.yaml

@@ -0,0 +1,4 @@
+Description: 'The rule detects access to sensitive browser data by a third-party process'
+EventDescriptions:
+    - LocalizationId: 'corrname_MacOS_Browser_cred_Access'
+      EventDescription: 'Process {subject.process.name} with pid {subject.process.id} has accessed browser file {object.fullpath}'

packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/i18n/i18n_ru.yaml

@@ -0,0 +1,4 @@
+Description: 'Правило детектирует доступ к чувствительным данным браузера сторонним процессом'
+EventDescriptions:
+    - LocalizationId: 'corrname_MacOS_Browser_cred_Access'
+      EventDescription: 'Процесс {subject.process.name} с pid {subject.process.id} получил доступ к файлу браузера {object.fullpath}'

packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/metainfo.yaml

@@ -0,0 +1,22 @@
+ContentAutoName: MacOS_Browser_cred_Access
+ExpertContext:
+    Created: 08.07.2024
+    Updated: 08.07.2024
+    KnowledgeHolders:
+        - Kirill Aparkin (Phoevek)
+    Usecases:
+        - Правило детектирует доступ к браузерным файлам сторонним процессом
+    Falsepositives:
+        - Если процесс легитимен
+    References: []
+    Improvements:
+        - Вайтлистами
+ObjectId: SEC-CR-203098059
+ContentRelations:
+    Implements:
+        ATTACK:
+            credential-access:
+                - T1555.003
+EventDescriptions:
+    - Criteria: correlation_name = "MacOS_Browser_cred_Access"
+      LocalizationId: corrname_MacOS_Browser_cred_Access

packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/rule.co

@@ -0,0 +1,91 @@
+event Browser_Access:
+    key:
+        event_src.host, subject.process.id
+    filter {
+        filter::NotFromCorrelator()
+        and action == 'read'
+        and regex(lower(object.fullpath),"(\/users\/|~).*?(chrome|chromium|firefox|yandex|opera|safari|browser)",0 ) != null
+    }
+
+event Uncomon_Process:
+    key:
+        event_src.host, object.process.id
+    filter {
+        filter::NotFromCorrelator()
+        and action == 'execute'
+        and regex(lower(object.process.name), "chrome|chromium|firefox|yandex|opera|safari", 0) == null
+    }
+
+rule MacOS_Browser_cred_Access: Browser_Access and Uncomon_Process
+
+    on Browser_Access {
+
+        $object.name = object.name
+        $object.path = object.path
+        $object.fullpath = object.fullpath
+
+        $alert.context = object.fullpath
+
+        $subject.account.name = subject.account.name
+        $subject.account.session_id = subject.account.session_id
+        $subject.account.id = subject.account.id
+    }
+
+    on Uncomon_Process {
+        $datafield1 = datafield1
+        $datafield2 = datafield2
+        $datafield3 = datafield3
+        $datafield4 = datafield4
+        $datafield5 = datafield5
+        $datafield6 = datafield6
+        $datafield7 = datafield7
+        $datafield8 = datafield8
+        $datafield9 = datafield9
+        $datafield10 = datafield10
+
+        $atafield12 =  datafield12
+        $datafield13 = datafield13
+        $datafield14 = datafield14
+        $datafield15 = datafield15
+        $datafield16 = datafield16
+        $datafield17 = datafield17
+        $datafield18 = datafield18
+
+
+
+        $subject.process.id = object.process.id
+        $subject.process.name = object.process.name
+        $subject.process.path = object.process.path
+        $subject.process.fullpath = object.process.fullpath
+        $subject.process.hash = object.process.hash
+        $subject.process.cmdline = object.process.cmdline
+        $subject.process.cwd = object.process.cwd
+
+
+        $object.process.parent.name = subject.process.name
+        $object.process.parent.path = subject.process.path
+        $object.process.parent.fullpath = subject.process.fullpath
+
+        $alert.key = join([lower(object.process.name), lower($object.fullpath)], "|")
+
+    }
+
+emit {
+    $correlation_type = "incident"
+
+    $subject = "process"
+    $action = "access"
+    $object = "file_object"
+    $status = "success"
+
+    $importance = "medium"
+
+    $category.generic = "Attack"
+    $category.high = "Credential Access"
+    $category.low = "Credetial Access"
+
+    $incident.aggregation.key = join([$correlation_name, lower($event_src.host), lower($subject.account.id)], "|")
+    $incident.severity = $importance
+    $incident.category = "Undefined"
+    $incident.aggregation.timeout = 2h
+}

packages/macos_open_package/correlation_rules/mitre_attck_cred_access/MacOS_Browser_cred_Access/tests/raw_events_1.json

@@ -0,0 +1,2 @@
+{"body":"{\"schema_version\":1,\"mach_time\":553612764272,\"event_type\":9,\"thread\":{\"thread_id\":88925},\"version\":7,\"seq_num\":24,\"event\":{\"exec\":{\"script\":null,\"last_fd\":2,\"target\":{\"signing_id\":\"com.apple.sh\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":570492929,\"executable\":{\"path\":\"\\/bin\\/sh\",\"stat\":{\"st_blocks\":24,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":0,\"st_gid\":0,\"st_ino\":1152921500312435312,\"st_birthtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_flags\":524320,\"st_nlink\":1,\"st_mtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_ctimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_size\":134000,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2023-07-11T08:56:22.000000000Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":true,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6712,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"A09AFAD27F2DFD0CE1410259676632952B1749FB\",\"team_id\":null},\"image_cpusubtype\":-2147483646,\"image_cputype\":16777228,\"fds\":[{\"fd\":0,\"fdtype\":1},{\"fd\":1,\"pipe\":{\"pipe_id\":1840},\"fdtype\":6},{\"fd\":2,\"fdtype\":1}],\"env\":[\"TERM_SESSION_ID=w1t0p0:989C730D-8929-4EA4-90E4-043570A53A14\",\"SSH_AUTH_SOCK=\\/private\\/tmp\\/com.apple.launchd.i3wu0PDT78\\/Listeners\",\"LC_TERMINAL_VERSION=3.4.22\",\"COLORFGBG=15;0\",\"ITERM_PROFILE=Default\",\"XPC_FLAGS=0x0\",\"PWD=\\/Users\\/user\\/Desktop\",\"SHELL=\\/bin\\/zsh\",\"__CFBundleIdentifier=com.googlecode.iterm2\",\"SECURITYSESSIONID=186a4\",\"LC_CTYPE=UTF-8\",\"TERM_PROGRAM_VERSION=3.4.22\",\"TERM_PROGRAM=iTerm.app\",\"PATH=\\/opt\\/homebrew\\/bin:\\/opt\\/homebrew\\/sbin:\\/usr\\/local\\/bin:\\/System\\/Cryptexes\\/App\\/usr\\/bin:\\/usr\\/bin:\\/bin:\\/usr\\/sbin:\\/sbin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/local\\/bin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/bin:\\/var\\/run\\/com.apple.security.cryptexd\\/codex.system\\/bootstrap\\/usr\\/appleinternal\\/bin\",\"LC_TERMINAL=iTerm2\",\"COLORTERM=truecolor\",\"COMMAND_MODE=unix2003\",\"TERM=xterm-256color\",\"HOME=\\/Users\\/user\",\"TMPDIR=\\/var\\/folders\\/n1\\/s1s8jdd919s8djb84sr3myrw0000gn\\/T\\/\",\"USER=user\",\"XPC_SERVICE_NAME=0\",\"LOGNAME=user\",\"LaunchInstanceID=0A2F69D4-87CF-4D66-9EF3-62CA1039F55A\",\"ITERM_SESSION_ID=w1t0p0:989C730D-8929-4EA4-90E4-043570A53A14\",\"__CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0\",\"SHLVL=1\",\"OLDPWD=\\/Users\\/user\",\"HOMEBREW_PREFIX=\\/opt\\/homebrew\",\"HOMEBREW_CELLAR=\\/opt\\/homebrew\\/Cellar\",\"HOMEBREW_REPOSITORY=\\/opt\\/homebrew\",\"MANPATH=\\/opt\\/homebrew\\/share\\/man::\",\"INFOPATH=\\/opt\\/homebrew\\/share\\/info:\",\"P9K_TTY=old\",\"_P9K_TTY=\\/dev\\/ttys001\",\"ZSH=\\/Users\\/user\\/.oh-my-zsh\",\"PAGER=less\",\"LESS=-R\",\"LSCOLORS=Gxfxcxdxbxegedabagacad\",\"LS_COLORS=di=1;36:ln=35:so=32:pi=33:ex=31:bd=34;46:cd=34;43:su=30;41:sg=30;46:tw=30;42:ow=30;43\",\"P9K_SSH=0\",\"_P9K_SSH_TTY=\\/dev\\/ttys001\",\"_=\\/Users\\/user\\/Desktop\\/.\\/mac_server_arm64\"],\"args\":[\"sh\",\"-c\",\"ditto -c -k --sequesterRsrc --keepParent \\/Users\\/user\\/1547562099 \\/Users\\/user\\/1547562099.zip --norsrc --noextattr\"],\"cwd\":{\"path\":\"\\/Users\\/user\\/Desktop\",\"stat\":{\"st_blocks\":0,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":21685,\"st_birthtimespec\":\"2023-07-11T09:26:21.000000000Z\",\"st_flags\":0,\"st_nlink\":15,\"st_mtimespec\":\"2024-03-13T12:49:17.561076436Z\",\"st_ctimespec\":\"2024-03-13T12:49:17.561076436Z\",\"st_size\":480,\"st_gen\":0,\"st_mode\":16832,\"st_atimespec\":\"2024-03-13T12:49:17.573110420Z\"},\"path_truncated\":false},\"dyld_exec_path\":\"\\/bin\\/sh\"}},\"time\":\"2024-03-13T13:20:11.569120699Z\",\"action\":{\"result\":{\"result\":{\"auth\":0},\"result_type\":0}},\"process\":{\"signing_id\":\"huy-55554944ea13e6c02eaf3a6ca71dc5742a9f368b\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":838860839,\"executable\":{\"path\":\"\\/Users\\/user\\/Desktop\\/Trading View\",\"stat\":{\"st_blocks\":1552,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":548344,\"st_birthtimespec\":\"2023-08-25T12:59:53.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2023-08-25T12:59:53.000000000Z\",\"st_ctimespec\":\"2024-03-13T12:52:44.385162893Z\",\"st_size\":790688,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2024-03-13T13:19:02.574080477Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":false,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6711,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"9820C1FD478A16B52E0EBC457AA319FCA33F5B3E\",\"team_id\":null},\"action_type\":1,\"global_seq_num\":3327}","recv_ipv4":"127.0.0.1","recv_time":"2024-07-08T15:42:30.158Z","task_id":"00000000-0000-0000-0000-000000000000","tag":"some_tag","mime":"application/json","normalized":false,"input_id":"00000000-0000-0000-0000-000000000000","type":"raw","uuid":"28eab79c-4496-484d-940f-68110ae2f1a5"}
+{"body":"{\"schema_version\":1,\"mach_time\":553613251269,\"event_type\":10,\"thread\":{\"thread_id\":89233},\"version\":7,\"seq_num\":3301,\"event\":{\"open\":{\"fflag\":257,\"file\":{\"path\":\"\\/Users\\/user\\/1547562099\\/Chromium\\/Chrome\\/Password1\",\"stat\":{\"st_blocks\":80,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":501,\"st_gid\":20,\"st_ino\":554231,\"st_birthtimespec\":\"2024-03-13T13:19:06.717063974Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.717167558Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.717175975Z\",\"st_size\":40960,\"st_gen\":0,\"st_mode\":33152,\"st_atimespec\":\"2024-03-13T13:20:11.589370456Z\"},\"path_truncated\":false}}},\"time\":\"2024-03-13T13:20:11.589412456Z\",\"action\":{\"result\":{\"result\":{\"flags\":4294967295},\"result_type\":1}},\"process\":{\"signing_id\":\"com.apple.ditto\",\"parent_audit_token\":{\"asid\":100004,\"pidversion\":6677,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3408},\"codesigning_flags\":570509825,\"executable\":{\"path\":\"\\/usr\\/bin\\/ditto\",\"stat\":{\"st_blocks\":72,\"st_blksize\":4096,\"st_rdev\":0,\"st_dev\":16777232,\"st_uid\":0,\"st_gid\":0,\"st_ino\":1152921500312435792,\"st_birthtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_flags\":524320,\"st_nlink\":1,\"st_mtimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_ctimespec\":\"2023-07-11T08:56:22.000000000Z\",\"st_size\":205296,\"st_gen\":0,\"st_mode\":33261,\"st_atimespec\":\"2023-07-11T08:56:22.000000000Z\"},\"path_truncated\":false},\"ppid\":3408,\"tty\":{\"path\":\"\\/dev\\/ttys001\",\"stat\":{\"st_blocks\":0,\"st_blksize\":65536,\"st_rdev\":268435457,\"st_dev\":-2023536355,\"st_uid\":501,\"st_gid\":4,\"st_ino\":1199,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0,\"st_nlink\":1,\"st_mtimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_ctimespec\":\"2024-03-13T13:19:06.840766000Z\",\"st_size\":0,\"st_gen\":0,\"st_mode\":8592,\"st_atimespec\":\"2024-03-13T13:18:46.317447000Z\"},\"path_truncated\":false},\"start_time\":\"2024-03-13T13:20:11.568209Z\",\"is_platform_binary\":true,\"group_id\":3408,\"audit_token\":{\"asid\":100004,\"pidversion\":6714,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":3419},\"is_es_client\":false,\"responsible_audit_token\":{\"asid\":100004,\"pidversion\":890,\"ruid\":501,\"euid\":501,\"rgid\":20,\"auid\":501,\"egid\":20,\"pid\":365},\"session_id\":689,\"original_ppid\":3408,\"cdhash\":\"3BE1641216D62565858F47D33B6D16C7D2DC0518\",\"team_id\":null},\"action_type\":1,\"global_seq_num\":3366}","recv_ipv4":"127.0.0.1","recv_time":"2024-07-08T15:56:46.210Z","task_id":"00000000-0000-0000-0000-000000000000","tag":"some_tag","mime":"application/json","normalized":false,"input_id":"00000000-0000-0000-0000-000000000000","type":"raw","uuid":"19aa2026-3600-4101-9469-749cb0629da7"}