meta_content and json_meta_content modifier

[bryant-smith]

The meta_content and json_meta_content both accept multiple multiple value can are compared based on OR logic, meaning only one needs to match to make the statement true. What about a & modifier to change them to use AND logic and have to match all value? This of course can be done with multiple json_content statements but may look cleaner for certain usages.

This can also be accomplished with json_pcre but may be faster than using pcre?

Current Usage:
json_content:".SourceImage", "|5c|AppData|5c|Local|5c|"; json_content:".SourceImage","|2e|exe"; distance:0; within:100;

Proposed Usage:
json_meta_content:&".SourceImage",|5c|AppData|5c|Local|5c|, |2e|exe;

The proposed usage can even be processed in order. So in this example it would have to match |5c|AppData|5c|Local|5c| first then |2e|exe would be next and have to be found after the first match. This may need an additional modifier like json_meta_ordered;

json_meta_content:&".SourceImage",|5c|AppData|5c|Local|5c|, |2e|exe; json_meta_ordered;

[quadrantsec]

Not sure about this.

First off, "distance" and "within" won't apply to json_content.

json_content is in the order it is placed in the signature. So your first example would be an and. If the first json_content doesn't match, it will never get to the second json_content.

[bryant-smith]

{"Event":{"attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"EventData":{"NewThreadId":3064,"RuleName":"technique_id=T1055,technique_name=Process Injection","SourceImage":"C:\\Users\\priyanka.villarreal\\AppData\\Local\\FrlxbduRbdVAbVbS\\UOmCgbXygCe.exe","SourceProcessGuid":"AD7D8466-6822-6286-232C-000000000800","SourceProcessId":10256,"SourceUser":"swutrust\\Priyanka.Villarreal","StartAddress":"0x000001AC40D70002","StartFunction":"-","StartModule":"-","TargetImage":"C:\\Windows\\System32\\svchost.exe","TargetProcessGuid":"AD7D8466-9737-6271-CD14-000000000800","TargetProcessId":4616,"TargetUser":"swutrust\\Priyanka.Villarreal","UtcTime":"2022-05-19 15:56:58.046"},"System":{"Channel":"Microsoft-Windows-Sysmon/Operational","Computer":"W9CJMSC13JQ.swutrust.local","Correlation":null,"EventID":8,"EventRecordID":200524,"Execution":{"attributes":{"ProcessID":3352,"ThreadID":4132}},"Keywords":"0x8000000000000000","Level":4,"Opcode":0,"Provider":{"attributes":{"Guid":"5770385F-C22A-43E0-BF4C-06F5698FFBD9","Name":"Microsoft-Windows-Sysmon"}},"Security":{"attributes":{"UserID":"S-1-5-18"}},"Task":8,"TimeCreated":{"attributes":{"SystemTime":"2022-05-19T15:56:58.056317Z"}},"Version":2}}}

Let's say I want to detect an exe in the \AppData\Local directory. With the current usage I would need to do something like:

Current Usage:
json_content:".Event.EventData.SourceImage","|5c|AppData|5c|Local"; json_contains; json_content:".Event.EventData.SourceImage","|2e|exe"; json_contains;

My proposal would be to put it all in one statement, prepended with the & symbol.

Proposed Usage:

json_meta_content:&".Event.EventData.SourceImage",|5c|AppData|5c|Local|5c|, |2e|exe;
meta_content:&"%sagan%",|5c|AppData|5c|Local|5c|, |2e|exe;

In the proposed statement instead of json_meta_conent looking for |5c|AppData|5c|Local|5c| OR |2e|exe, it will look for |5c|AppData|5c|Local|5c| AND |2e|exe