ocsf-schema icon indicating copy to clipboard operation
ocsf-schema copied to clipboard

Issues with recently added Script Activity class

Open davemcatcisco opened this issue 1 year ago • 0 comments

PR 1159 added the Script Activity event class to the schema. It was authored by myself and merged on 22nd August. Within a week of this, I realised on trying to implement this in our product there were two omissions in this original PR:

  1. I forgot to include an entry in the type_id enum for VBA macros as used in Word docs, Excel sheets, etc. As folks will no doubt be aware, this is one of the most common techniques used by adversaries.
  2. When a script is very large (e.g. Mimikatz) and the security product truncates what gets included in the script object, I forgot to provide a flag so that the product could indicate that it had truncated the script.

Additonally, at the time of the original PR I was asked to clarify the language in some of the descriptions for the new schema objects.

I actually did all of the above locally at the time but forgot to open an issue and PR here until about 10 minutes ago. Sorry! I'll open a PR for this issue in a few mins.

davemcatcisco avatar Oct 08 '24 11:10 davemcatcisco