Panther rules: cb

PREFIXES = ("Updated grant: ", "Created grant: ")


def rule(event):
    desc = event.get("description", "")
    return all(
        [
            event.get("requestUrl", "").startswith("/access/"),
            any(desc.startswith(prefix) for prefix in PREFIXES),
            "Admin" in desc,
        ]
    )


def title(event):
    user = event.get("loginName", "<NO_USERNAME_FOUND>")
    ip_addr = event.get("clientIp", "<NO_IP_FOUND>")
    desc = event.get("description", "<NO_DESCRIPTION_FOUND>")
    return f"{user} [{ip_addr}] {desc}"


def severity(event):
    if "Super Admin" in event.get("description", ""):
        return "CRITICAL"
    return "HIGH"

AnalysisType: rule
RuleID: "CarbonBlack.Audit.Admin.Grant"
LogTypes:
  - CarbonBlack.Audit
Description: "Detects when a user is granted Admin or Super Admin permissions."
DisplayName: "Carbon Black Admin Role Granted"
Enabled: true
Filename: cb_audit_admin_grant.py
Severity: High
Tags:
  - Privilege Escalation
  - Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0004:T1098
Reference: https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-CF5ACD2C-A534-46C8-AE06-E1884DB37B58.html
Threshold: 1
DedupPeriodMinutes: 60

PATTERNS = (
    " retrieved secret for API ID ",
    "Added API ID ",
    "Regenerated API key for API ID ",
    "Updated API ID ",
)


def rule(event):
    desc = event.get("description", "")
    return any(pattern in desc for pattern in PATTERNS)


def title(event):
    user = event.get("loginName", "<NO_USERNAME_FOUND>")
    ip_addr = event.get("clientIp", "<NO_IP_FOUND>")
    desc = event.get("description", "<NO_DESCRIPTION_FOUND>")
    return f"{user} [{ip_addr}] {desc}"

AnalysisType: rule
RuleID: "CarbonBlack.Audit.API.Key.Created.Retrieved"
LogTypes:
  - CarbonBlack.Audit
Description: "Detects when a user creates a new API key or retrieves an existing key."
DisplayName: "Carbon Black API Key Created or Retrieved"
Enabled: true
Filename: cb_audit_api_key_created_retrieved.py
Severity: Medium
Tags:
  - Persistence
  - Create Account
Reports:
  MITRE ATT&CK:
    - TA0003:T1136
Reference: https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-F3816FB5-969F-4113-80FC-03981C65F969.html
Threshold: 1
DedupPeriodMinutes: 60

ACTION = ""


def rule(event):
    # pylint: disable=global-statement
    global ACTION
    if not event.get("requestUrl", "").startswith("/data_forwarder/"):
        return False
    desc = event.get("description", "")
    if desc.startswith("Deleted Config: "):
        ACTION = "Deleted"
        return True
    if desc.startswith("Updated Config: ") and '"enabled":false' in desc:
        ACTION = "Disabled"
        return True
    return False


def title(event):
    user = event.get("loginName", "<NO_USERNAME_FOUND>")
    ip_addr = event.get("clientIp", "<NO_IP_FOUND>")
    return f"{user} [{ip_addr}] {ACTION} Data Forwarder"


def description(event):
    user = event.get("loginName")
    ip_addr = event.get("clientIp")
    desc = event.get("description")
    return f"{user} [{ip_addr}] {desc}"

AnalysisType: rule
RuleID: "CarbonBlack.Audit.Data.Forwarder.Stopped"
LogTypes:
  - CarbonBlack.Audit
Description: "Detects when a user disables or deletes a Data Forwarder."
DisplayName: "Carbon Black Data Forwarder Stopped"
Enabled: true
Filename: cb_audit_data_forwarder_stopped.py
Severity: High
Tags:
  - Defense Evasion
  - Impair Defenses
  - Disable or Modify Cloud Logs
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008
Reference: https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-E8D33F72-BABB-4157-A908-D8BBDB5AF349.html
Threshold: 1
DedupPeriodMinutes: 60

def rule(event):
    return event.get("flagged", False)


def title(event):
    user = event.get("loginName", "<NO_USERNAME_FOUND>")
    ip_addr = event.get("clientIp", "<NO_IP_FOUND>")
    desc = event.get("description", "<NO_DESCRIPTION_FOUND>")
    return f"{user} [{ip_addr}] {desc}"


def severity(event):
    if event.get("description").startswith("Requested sensor update"):
        return "INFO"
    return "DEFAULT"

AnalysisType: rule
RuleID: "CarbonBlack.Audit.Flagged"
LogTypes:
  - CarbonBlack.Audit
Description: "Detects when Carbon Black has flagged a log as important, such as failed login attempts and locked accounts."
DisplayName: "Carbon Black Log Entry Flagged"
Enabled: true
Filename: cb_audit_flagged.py
Severity: Medium
Tags:
  - Credential Access
  - Brute Force
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Reference: https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-FB61E4E3-6431-4226-A4E3-5949FB75922B.html
Threshold: 1
DedupPeriodMinutes: 60

def rule(event):
    return event.deep_get("workflow", "changed_by") == "ALERT_CREATION"


def title(event):
    return (
        f"{event.get('attack_tactic', 'CB')}: "
        f"{event.get('device_username', '<no-user-found>')} on "
        f"{event.get('device_name', '<no-device-found>')}: "
        f"{event.get('reason', '<no-reason-found>')}"
    )


def description(event):
    return event.get("reason", "<no-reason-found>")


def severity(event):
    sev = event.get("severity")
    if sev >= 8:
        return "CRITICAL"
    if sev >= 6:
        return "HIGH"
    if sev >= 4:
        return "MEDIUM"
    if sev >= 2:
        return "LOW"
    return "INFO"


def reference(event):
    return event.get("alert_url")


def dedup(event):
    return event.get("id")

AnalysisType: rule
RuleID: CarbonBlack.AlertV2.Passthrough
Description: This rule enriches and contextualizes security alerts generated by Carbon Black.  The alert title and description are dynamically updated based on data included in the alert log.
DisplayName: Carbon Black Passthrough Rule
Runbook: Review the Carbon Black alert details to determine what malicious behavior was detected, and whether or not it was blocked.  Use the Reference link to view the alert in the Carbon Black console and take remediating actions if necessary.
Reference: https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-0B68199D-6411-45D1-AE0D-2AB9B7A28513.html
Enabled: true
Filename: cb_passthrough.py
LogTypes:
  - CarbonBlack.AlertV2
Severity: Medium
DedupPeriodMinutes: 30
Threshold: 1
SummaryAttributes:
  - attack_tactic
  - blocked_name
  - device_name
  - device_username
  - primary_event_id
  - reason
  - threat_id

PATTERNS = ("Added user ",)


def rule(event):
    desc = event.get("description", "")
    if not any(desc.startswith(pattern) for pattern in PATTERNS):
        return False
    src_user = event.get("loginName", "")
    src_domain = src_user.split("@")[1]
    dst_user = desc.split(" ")[2]
    dst_domain = dst_user.split("@")[1]
    if src_domain != dst_domain:
        return True
    return False


def title(event):
    user = event.get("loginName", "<NO_USERNAME_FOUND>")
    ip_addr = event.get("clientIp", "<NO_IP_FOUND>")
    desc = event.get("description", "<NO_DESCRIPTION_FOUND>")
    return f"{user} [{ip_addr}] {desc}"

AnalysisType: rule
RuleID: "CarbonBlack.Audit.User.Added.Outside.Org"
LogTypes:
  - CarbonBlack.Audit
Description: "Detects when a user from a different organization is added to Carbon Black."
DisplayName: "Carbon Black User Added Outside Org"
Enabled: true
Filename: cb_audit_user_added_outside_org.py
Severity: High
Tags:
  - Persistence
  - Create Account
Reports:
  MITRE ATT&CK:
    - TA0003:T1136
Reference: https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-516BAF8C-A13D-4FC7-AA92-923159C13083.html
Threshold: 1
DedupPeriodMinutes: 60