ocsf-schema
ocsf-schema copied to clipboard
Issues with recently added Script Activity class
PR 1159 added the Script Activity event class to the schema. It was authored by myself and merged on 22nd August. Within a week of this, I realised on trying to implement this in our product there were two omissions in this original PR:
- I forgot to include an entry in the
type_idenum for VBA macros as used in Word docs, Excel sheets, etc. As folks will no doubt be aware, this is one of the most common techniques used by adversaries. - When a script is very large (e.g. Mimikatz) and the security product truncates what gets included in the
scriptobject, I forgot to provide a flag so that the product could indicate that it had truncated the script.
Additonally, at the time of the original PR I was asked to clarify the language in some of the descriptions for the new schema objects.
I actually did all of the above locally at the time but forgot to open an issue and PR here until about 10 minutes ago. Sorry! I'll open a PR for this issue in a few mins.