Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new rules in tag_windows.txt to application_execution tag #4376

Open
wants to merge 17 commits into
base: main
Choose a base branch
from

Conversation

lprat
Copy link
Contributor

@lprat lprat commented Nov 10, 2022

One line description of pull request

Add new tag in data/tag_windows.txt to "application_execution".

Description:

Add new tag in data/tag_windows.txt to "application_execution":

  • Event "Microsoft-Windows-Program-Compatibility-Assistant" id 17 :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Program-Compatibility-Assistant" Guid="{}"/>
    <EventID>17</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2020-07-03T09:12:24.307780200Z"/>
    <EventRecordID>2</EventRecordID>
    <Correlation/>
    <Execution ProcessID="992" ThreadID="3588"/>
    <Channel>Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant</Channel>
    <Computer>...</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <ResolverFiredEvent xmlns="http://www.microsoft.com/Windows/Diagnosis/PCA/events">
      <ExePath>C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</ExePath>
      <ResolverName>WrpMitigation</ResolverName>
    </ResolverFiredEvent>
  </UserData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Application-Experience" Guid="{}"/>
    <EventID>500</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x0800000000000000</Keywords>
    <TimeCreated SystemTime="2018-02-15T12:09:42.471850900Z"/>
    <EventRecordID>55</EventRecordID>
    <Correlation/>
    <Execution ProcessID="10352" ThreadID="9632"/>
    <Channel>Microsoft-Windows-Application-Experience/Program-Telemetry</Channel>
    <Computer>example</Computer>
    <Security UserID="S-1-5-20"/>
  </System>
  <UserData>
    <CompatibilityFixEvent xmlns="http://www.microsoft.com/Windows/Diagnosis/PCA/events">
      <ProcessId>10352</ProcessId>
      <StartTime>2018-02-15T12:09:42.466668000Z</StartTime>
      <FixID>{}</FixID>
      <Flags>0x00040102</Flags>
      <ExePath>C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\{}\MPSigStub.exe</ExePath>
      <FixName>RunAsInvoker</FixName>
    </CompatibilityFixEvent>
  </UserData>
</Event>
{"Event":{"System":{"Channel":"Microsoft-Windows-Application-Experience/Program-Telemetry","Computer":"example","Correlation":{},"EventID":"505","EventRecordID":"51","Execution":{"ProcessID":"4596","ThreadID":"5488"},"Keywords":"0x800000000000000","Level":"4","Opcode":"0","Provider":{"Guid":"","Name":"Microsoft-Windows-Application-Experience"},"Security":{"UserID":"S-1-5-18"},"Task":"0","TimeCreated":{"SystemTime":"2020-01-13T14:59:48.5438676Z"},"Version":"0"},"UserData":{"CompatibilityFixEvent":{"ExePath":"E:\\jdk1.6.0_18\\bin\\java.exe","FixID":","FixName":"010 Legacy Registry Entries (User Compat Flags)","Flags":"0x80010101","ProcessId":"4596","StartTime":"2020-01-13T14:59:48.4979961Z","xmlns":"http://www.microsoft.com/Windows/Diagnosis/PCA/events"}}}}

Notes:

All contributions to Plaso undergo code
review
. This makes sure
that the code has appropriate test coverage and conforms to the Plaso style
guide
.

One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.

Checklist:

  • Automated checks (Travis, Codecov, Codefactor )pass
  • No new new dependencies are required or l2tdevtools has been updated
  • Reviewer assigned

@joachimmetz joachimmetz self-assigned this Nov 11, 2022
@joachimmetz
Copy link
Member

@lprat FYI tests are failing due to an issue flagged by the linter

tests/data/tag_windows.py:275:171: E0001: (unicode error) 'unicodeescape' codec can't decode bytes in position 113-114: truncated \xXX escape (<unknown>, line 275) (syntax-error)

event.timestamp = self._TEST_TIMESTAMP
event.timestamp_desc = definitions.TIME_DESCRIPTION_UNKNOWN

event_data = {}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't do it like this. Use the corresponding event data object instead.

The intent of these test are to catch issues when the event data objects change.

@codecov
Copy link

codecov bot commented Nov 17, 2022

Codecov Report

Base: 85.77% // Head: 85.71% // Decreases project coverage by -0.05% ⚠️

Coverage data is based on head (737a960) compared to base (aa36de5).
Patch has no changes to coverable lines.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4376      +/-   ##
==========================================
- Coverage   85.77%   85.71%   -0.06%     
==========================================
  Files         413      413              
  Lines       35449    35430      -19     
==========================================
- Hits        30407    30370      -37     
- Misses       5042     5060      +18     
Impacted Files Coverage Δ
plaso/parsers/text_plugins/ios_logd.py 88.33% <0.00%> (-3.34%) ⬇️
plaso/parsers/text_plugins/sophos_av.py 83.60% <0.00%> (-3.28%) ⬇️
plaso/parsers/text_plugins/selinux.py 89.06% <0.00%> (-3.13%) ⬇️
plaso/parsers/text_plugins/xchatscrollback.py 89.06% <0.00%> (-3.13%) ⬇️
plaso/parsers/text_plugins/dpkg.py 87.69% <0.00%> (-3.08%) ⬇️
plaso/single_process/extraction_engine.py 76.25% <0.00%> (-2.92%) ⬇️
plaso/parsers/text_plugins/aws_elb_access.py 95.26% <0.00%> (-2.70%) ⬇️
plaso/parsers/text_plugins/setupapi.py 93.50% <0.00%> (-2.60%) ⬇️
plaso/parsers/text_plugins/interface.py 85.71% <0.00%> (-2.53%) ⬇️
plaso/parsers/text_plugins/snort_fastlog.py 93.97% <0.00%> (-2.41%) ⬇️
... and 56 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@lprat
Copy link
Contributor Author

lprat commented Nov 17, 2022

Sorry for all the corrections! I hope it's good for you?

@joachimmetz
Copy link
Member

@lprat no worries, take your time. I'll try to have a look tomorrow, when time permits.

@joachimmetz joachimmetz self-requested a review November 18, 2022 04:03
@joachimmetz joachimmetz added the needs closer look Issue that requires further analysis by a maintainer label Nov 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs closer look Issue that requires further analysis by a maintainer
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants