yyy_c_Detection - Suspicious Crash of Microsoft Malware Protection Engine.json

{
  "flows": [
    {
      "name": "yyy_c_Detection - Suspicious Crash of Microsoft Malware Protection Engine",
      "nodes": [
        {
          "id": "9b108d1b-037f-43a5-8e54-875a66a0b704",
          "name": "Output",
          "kind": "output",
          "warnings": [],
          "description": "",
          "nodes": [
            "062c2563-35f2-4e59-96e1-96b384d882d5"
          ],
          "isExplainable": true,
          "x": 0,
          "y": 526,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "categoryKind": "Unknown",
          "iconTitle": "Unknown",
          "usedByEventTypes": []
        },
        {
          "id": "ff932cc6-26b5-4815-9f03-f046df8616a0",
          "name": "reformat_input",
          "kind": "augmentation",
          "lql": "`SELECT lhub_ts, src_machine_name, src_machine_fqdn, event_id, source_name, fault_message, _messageid, _raw\nFROM Windows_Suspicious_Crash_of_Microsoft_Malware_Protection_Engine`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 0,
          "y": 132,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "fc189320-0f72-4910-88cd-c78b30d4b9e6",
          "name": "Windows_Suspicious_Crash_of_Microsoft_Malware_Protection_Engine",
          "kind": "eventType",
          "isLeaf": false,
          "eventType": "eventType-41",
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 0,
          "y": 0,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "EventTypeContentKind",
            "id": "eventType-41"
          },
          "categoryKind": "FetchData",
          "linkToTrigger": true,
          "iconTitle": "Fetch Data: Windows_Suspicious_Crash_of_Microsoft_Malware_Protection_Engine",
          "usedByEventTypes": []
        },
        {
          "id": "55deea34-68e0-4c84-be98-f6ddf02db4f1",
          "name": "format_alert",
          "kind": "augmentation",
          "lql": "`SELECT 'LH00205' AS alert_id,\n'Suspicious Crash of Microsoft Malware Protection Engine' AS alert_type,\nSTRUCT(event_id, source_name, fault_message, _messageid) AS additional_data,\n'Defense Evasion' AS tactic,\n'Disabling Security Tools' AS technique,\n3 AS risk_score,\n3 AS fidelity_score,\n*\nFROM reformat_input`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 0,
          "y": 244,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "062c2563-35f2-4e59-96e1-96b384d882d5",
          "name": "LogicHub_MDR_Format_Alert_for_Sumo",
          "kind": "step",
          "inputs": [
            "55deea34-68e0-4c84-be98-f6ddf02db4f1"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Format event output to send to SumoLogic destination",
          "isExplainable": true,
          "x": 0,
          "y": 356,
          "vertices": [],
          "title": "LogicHub MDR: Format Alert for Sumo",
          "moduleId": "logichub.mdr.format_alert_for_sumo",
          "moduleVersion": {
            "majorVersion": 1,
            "minorVersion": 31,
            "patchVersion": 0,
            "contentResourceVersionBranch": "Local"
          },
          "moduleParameters": {
            "parent0": "format_alert"
          },
          "stepParams": {
            "kind": "module",
            "title": "LogicHub MDR: Format Alert for Sumo"
          },
          "isEditable": true,
          "isStepImplementable": false,
          "executionDependsOn": [],
          "contentMetadata": {
            "id": "logichub.mdr.format_alert_for_sumo",
            "name": "LogicHub MDR: Format Alert for Sumo",
            "latestAvailableVersion": {
              "majorVersion": 1,
              "minorVersion": 31,
              "patchVersion": 0,
              "contentResourceVersionBranch": "Local"
            }
          },
          "outputtedNode": true,
          "contentItemIdentifier": {
            "kind": "ModuleContentKind",
            "id": "logichub.mdr.format_alert_for_sumo"
          },
          "categoryKind": "Module",
          "iconTitle": "Module: LogicHub MDR: Format Alert for Sumo",
          "usedByEventTypes": []
        }
      ],
      "oldId": "flow-1050",
      "listNames": [],
      "dependentCommands": [],
      "resourceFormatVersion": 2,
      "fileDataSeq": []
    }
  ],
  "baselines": [],
  "eventTypes": [
    {
      "id": "eventType-41",
      "data": {
        "name": "Windows_Suspicious_Crash_of_Microsoft_Malware_Protection_Engine",
        "query": "_sourceCategory=server/windows/events* (event_id=1000 or event_id=1001) \"Logfile = \\\"Application\\\"\" \"MsMpEng.exe\" \"mpengine.dll\"\n| parse \"SourceName = \\\"*\\\";\" as source_name\n| where source_name in (\"Application Error\", \"Windows Error Reporting\")\n| parse \"Computer = \\\"*\\\";\" as src_machine_fqdn\n| toLowerCase(src_machine_fqdn) as src_machine_fqdn\n| parse regex field=src_machine_fqdn \"(?<src_machine_name>\\S[^.]+)\" nodrop\n| parse \"Message = \\\"*\\\";\\n\" as fault_message nodrop",
        "keyColumns": "lhub_ts,src_machine_name,src_machine_fqdn,event_id,source_name,fault_message,_messageid,_raw",
        "connection": "connection-2",
        "connectionTypeEntities": {
          "entities": [
            {
              "connectionType": {
                "connectionType": "sumologic",
                "value": "query"
              },
              "connectionTypeDetail": {
                "query": "_sourceCategory=server/windows/events* (event_id=1000 or event_id=1001) \"Logfile = \\\"Application\\\"\" \"MsMpEng.exe\" \"mpengine.dll\"\n| parse \"SourceName = \\\"*\\\";\" as source_name\n| where source_name in (\"Application Error\", \"Windows Error Reporting\")\n| parse \"Computer = \\\"*\\\";\" as src_machine_fqdn\n| toLowerCase(src_machine_fqdn) as src_machine_fqdn\n| parse regex field=src_machine_fqdn \"(?<src_machine_name>\\S[^.]+)\" nodrop\n| parse \"Message = \\\"*\\\";\\n\" as fault_message nodrop",
                "connection": "connection-2"
              }
            }
          ]
        },
        "defaultConnectionType": {
          "connectionType": "sumologic",
          "value": "query"
        }
      }
    }
  ],
  "connections": [
    {
      "id": "connection-2",
      "data": {
        "connectionType": "sumologic",
        "name": "SumoLogic",
        "isActive": false,
        "account": "",
        "secret": "",
        "url": "https://api.us2.sumologic.com/api/v1"
      }
    }
  ],
  "modules": [
    {
      "id": "logichub.mdr.format_alert_for_sumo",
      "name": "LogicHub MDR: Format Alert for Sumo",
      "description": "Format event output to send to a SumoLogic destination",
      "templateNodes": [
        {
          "name": "alert_output_for_sumo",
          "templateLQL": "`SELECT \n/* always include lhub_score in the final output */\nlhub_score,\n\n/* format the final JSON output */\nTO_JSON(STRUCT(\n\n/* Required/Standard fields first */\nlhub_score, alert_time,\nlh_batch_end, lh_batch_id, lh_hostname, lh_alert_id,\nalert_id, alert_type, technique, tactic, risk_score, fidelity_score,\n\n/* All other fields EXCEPT additional_data */\nattack_chain, dest_ip, dest_machine_name, dest_machine_fqdn, dest_nt_domain, dest_port, dest_user, src_ip, src_machine_name, src_machine_fqdn, src_nt_domain, src_port, src_user,\n\n/* place additional_data last so it will be at the bottom of the JSON formatted output */\nadditional_data)) AS alert_output\nFROM validate_required_input`",
          "isOutput": true
        },
        {
          "name": "ensure_defined_fields_exist",
          "templateLQL": "ensureTableHasColumns(comment_ensure_table_has_columns, \"lhub_score, lhub_ts, alert_title, alert_time, alert_id, alert_type, technique, tactic, risk_score, fidelity_score, additional_data, attack_chain, dest_ip, dest_machine_name, dest_machine_fqdn, dest_nt_domain, dest_port, dest_user, src_ip, src_machine_name, src_machine_fqdn, src_nt_domain, src_port, src_user\")",
          "isOutput": false
        },
        {
          "name": "final_columns",
          "templateLQL": "`SELECT \n/* Required/standard fields first */\nlh__new_score AS lhub_score,\nlh__new_ts AS lhub_ts,\nlh__new_ts AS alert_time,\nlh_batch_end, lh_batch_id, lh_hostname, lh_alert_id,\nalert_id,\n\n/* Legacy support for \"alert_title\" which is now called \"alert_type\" */\nCOALESCEEMPTY(alert_type, alert_title) AS alert_type,\n\ntechnique, tactic, risk_score, fidelity_score,\n\n/* All other supported fields */\nadditional_data, attack_chain, dest_ip, dest_machine_name, dest_machine_fqdn, dest_nt_domain, dest_port, dest_user, src_ip, src_machine_name, src_machine_fqdn, src_nt_domain, src_port, src_user\n\nFROM calculate_new_score_and_time`",
          "isOutput": false
        },
        {
          "name": "add_batch_metadata",
          "templateLQL": "addExecutionMetadata(ensure_defined_fields_exist)",
          "isOutput": false
        },
        {
          "name": "calculate_new_score_and_time",
          "templateLQL": "`SELECT \n/* If lhub_score = 0, keep it 0, otherwise use the greater of the original value or risk times fidelity */\nCASE DOUBLE(lhub_score) WHEN 0 THEN DOUBLE(lhub_score) ELSE GREATEST(risk_score * fidelity_score, DOUBLE(lhub_score)) END AS lh__new_score,\n\n/* For timestamp, look first for alert_time, then lhub_ts, then batch end time */\nCASE\n  WHEN BIGINT(alert_time) IS NOT NULL THEN BIGINT(alert_time)\n  WHEN BIGINT(lhub_ts) IS NOT NULL THEN BIGINT(lhub_ts) ELSE BIGINT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.interval_end_millis\"))\nEND AS lh__new_ts,\n\nREGEXP_EXTRACT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.batch_url\"), '://(.*?)/') AS lh_hostname,\nREGEXP_EXTRACT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.batch_url\"), '(batch-\\\\d+)$') AS lh_batch_id,\nBIGINT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.interval_end_millis\")) AS lh_batch_end,\n\n/* Generate a unique (mostly) event ID from the batch number + lhub_id */\nBIGINT(PRINTF('%s%s', REGEXP_EXTRACT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.batch_url\"), 'batch-(\\\\d+)$'), lhub_id)) AS lh_alert_id,\n*\nFROM add_batch_metadata`",
          "isOutput": false
        },
        {
          "name": "comment_ensure_table_has_columns",
          "templateLQL": "`\n/* Since some columns are only conditionally required, there has to be a step to explicitly check for values in those fields anyway, so to keep it simple, all possible fields are protected in ensureTableHasColumns, and some are validated later to ensure that they have a value.\n\nFields supported but not part of the final JSON schema:\n- lhub_score - can be used to override final score\n- lhub_ts - when available, used to calculate alert_time\n- alert_title - legacy support, but since renamed to alert_type\n\nNot expected from input but allowed when available:\n- alert_time: calculated from lhub_ts or batch time, but if this is available then we'll accept it as truth\n\nAfter that, ALL SUPPORTED FIELDS from supported schema\nhttps://logichub.atlassian.net/wiki/spaces/CON/pages/797671425/Output+Schema+for+LogicHub+Content\n*/\n\nselect * from %%%parent0%%%`",
          "isOutput": false
        },
        {
          "name": "check_for_required_fields",
          "templateLQL": "`/*\nOnce all calculations are done, verify that all the required fields have values.\nNote that some fields allow empty strings for the time being, as long as they aren't null. This is just to allow us to transition into this new alert schema while we figure it all out.\n*/\n\nSELECT *,\nCASE\n    /* array_sort will put nulls at the end, so this is a quick way to check all required inputs at once */\n    WHEN ELEMENT_AT(ARRAY_SORT(ARRAY(alert_id, alert_type, technique, tactic, risk_score, fidelity_score)), -1) IS NULL THEN 'One or more required inputs is missing or null. Required fields: alert_id, alert_type, technique, tactic, risk_score, fidelity_score'\n    WHEN TRIM(alert_id) = '' THEN 'alert_id cannot be empty'\n    WHEN TRIM(alert_type) = '' THEN 'alert_type cannot be empty'\n    WHEN risk_score NOT IN (1, 2, 3) THEN PRINTF('Invalid value for risk_score (%s). Acceptable values are from 1 (low), 2 (medium) and 3 (high).', risk_score)\n    WHEN fidelity_score NOT IN (1, 2, 3) THEN PRINTF('Invalid value for fidelity_score (%s). Acceptable values are from 1 (low), 2 (medium) and 3 (high).', fidelity_score)\n    WHEN FLOAT(lhub_score) IS NULL THEN 'Unable to calculate lhub_score from provided columns'\n    WHEN lhub_score > 10 OR lhub_score < 0 THEN PRINTF('Invalid value for lhub_score (%s). Acceptable values are from 0-10.', lhub_score)\nEND AS error\n\nFROM final_columns`",
          "isOutput": false
        },
        {
          "name": "validate_required_input",
          "templateLQL": "forceFail(check_for_required_fields, \"error\")",
          "isOutput": false
        }
      ],
      "steps": [
        {
          "name": "Module Parameters",
          "description": "",
          "inputs": [
            {
              "id": "parent0",
              "description": "Parent node",
              "label": "Parent Node",
              "dataType": "node",
              "inputType": "columnSelect",
              "dependsOn": "",
              "columnTemplating": false
            }
          ],
          "isVariadic": false
        }
      ],
      "isPublished": true,
      "author": "chad@logichub.com",
      "categories": [],
      "isEditable": true,
      "integrations": [],
      "innerModules": [],
      "tags": [],
      "moduleVersion": {
        "majorVersion": 1,
        "minorVersion": 31,
        "patchVersion": 0,
        "contentResourceVersionBranch": "Local"
      },
      "isDataSource": "No",
      "resourceFormatVersion": 3,
      "weight": 0
    }
  ],
  "annotations": [],
  "filters": [],
  "ruleSets": [],
  "integrationInstances": [],
  "customLists": [],
  "streams": [],
  "dashboards": [],
  "images": [],
  "codeBlobs": {},
  "customListsData": {},
  "executionScripts": [],
  "userForms": [],
  "flowNodeReferences": [],
  "destinations": [],
  "fileResources": [],
  "fileDataSeq": [],
  "eventModels": [],
  "version": 1
}