From 5f4507812c6cce105c27263c739c1abf67c4f897 Mon Sep 17 00:00:00 2001 From: Asuka Nakajima Date: Fri, 25 Oct 2024 17:04:03 +0900 Subject: [PATCH 01/14] Update 0048-fileorigin-fields.md --- rfcs/text/0048-fileorigin-fields.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rfcs/text/0048-fileorigin-fields.md b/rfcs/text/0048-fileorigin-fields.md index 85622991b7..cd8b013928 100644 --- a/rfcs/text/0048-fileorigin-fields.md +++ b/rfcs/text/0048-fileorigin-fields.md @@ -1,8 +1,8 @@ # 0048: File Origin Fields -- Stage: **0 (strawperson)** -- Date: **2024-10-15** +- Stage: **1 (Draft)** +- Date: **2024-XX-XX** -* Stage 0: https://github.com/elastic/ecs/pull/2387 +* Stage 1: https://github.com/elastic/ecs/pull/2395 +* DLL +A process may load DLLs (libraries) as needed. However, there are cases where a malicious DLL prepared by an attacker might be loaded. To enhance security, we would like to check whether the loaded DLL was downloaded from the internet and, if so, where it was downloaded from. This information can help in determining whether the loaded DLL is malicious. + +* Process +Generally, a process is generated from an executable file. However, there's a possibility that the executable file originating the process could be malware. To enhance security, we aim to include the executable file’s origin information at the process creation event and use the origin URL to help determine if the file is malicious. + +* File +A file open event may be generated when a file is opened. By including the file's origin information in the event, the system can assess whether the file might be malware downloaded from a malicious website based on those URLs. + ## Source data +Example sources of data is shown in the above. + From f2df0556210f790b0b754820481210c7ab62a734 Mon Sep 17 00:00:00 2001 From: Asuka Nakajima Date: Fri, 25 Oct 2024 18:01:43 +0900 Subject: [PATCH 10/14] Update 0048-fileorigin-fields.md --- rfcs/text/0048-fileorigin-fields.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/rfcs/text/0048-fileorigin-fields.md b/rfcs/text/0048-fileorigin-fields.md index 5f05e853b3..eb75e78001 100644 --- a/rfcs/text/0048-fileorigin-fields.md +++ b/rfcs/text/0048-fileorigin-fields.md @@ -66,14 +66,12 @@ Stage 2: Add or update all remaining field definitions. The list should now be e Stage 1: Describe at a high-level how these field changes will be used in practice. Real world examples are encouraged. The goal here is to understand how people would leverage these fields to gain insights or solve problems. ~1-3 paragraphs. --> -* DLL -A process may load DLLs (libraries) as needed. However, there are cases where a malicious DLL prepared by an attacker might be loaded. To enhance security, we would like to check whether the loaded DLL was downloaded from the internet and, if so, where it was downloaded from. This information can help in determining whether the loaded DLL is malicious. - -* Process -Generally, a process is generated from an executable file. However, there's a possibility that the executable file originating the process could be malware. To enhance security, we aim to include the executable file’s origin information at the process creation event and use the origin URL to help determine if the file is malicious. - * File -A file open event may be generated when a file is opened. By including the file's origin information in the event, the system can assess whether the file might be malware downloaded from a malicious website based on those URLs. + * A file open event may be generated when a file is opened. By including the file's origin information in the event, the system can assess whether the file might be malware downloaded from a malicious website based on those URLs. +* Process + * Generally, a process is generated from an executable file. However, there's a possibility that the executable file originating the process could be malware. To enhance security, we aim to include the executable file’s origin information at the process creation event and use the origin URL to help determine if the file is malicious. +* DLL + * A process may load DLLs (libraries) as needed. However, there are cases where a malicious DLL prepared by an attacker might be loaded. To enhance security, we would like to check whether the loaded DLL was downloaded from the internet and, if so, where it was downloaded from. This information can help in determining whether the loaded DLL is malicious. ## Source data From a68ec71bf8efde70431df1bcab154eddf0955487 Mon Sep 17 00:00:00 2001 From: Asuka Nakajima Date: Thu, 5 Dec 2024 14:44:48 +0900 Subject: [PATCH 11/14] Update 0048-fileorigin-fields.md --- rfcs/text/0048-fileorigin-fields.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/rfcs/text/0048-fileorigin-fields.md b/rfcs/text/0048-fileorigin-fields.md index eb75e78001..4df7c5ef7f 100644 --- a/rfcs/text/0048-fileorigin-fields.md +++ b/rfcs/text/0048-fileorigin-fields.md @@ -26,7 +26,7 @@ For example, in Windows, when you download an image file (`image17.webp`) from [ In ensuring endpoint security, the origin information of a file is crucial for determining whether a downloaded file or executable from the internet comes from a safe source and if it is safe to execute. Thus, this PR adds new fields to store the URL of the file's origin information for `file`, `process`, and `dll`. -The ReferrerUrl is intended to be stored in the `origin_referrer_url` field, and the `HostUrl` is inteded to be stored in the `origin_url` field. The ZoneId is intended to be stored in the `zone_identifier` field. +The ReferrerUrl is intended to be stored in the `origin_referrer_url` field, and the `HostUrl` is inteded to be stored in the `origin_url` field.