feat: enhanced EVTX collection and event logs web UI with Sigma support#2939
feat: enhanced EVTX collection and event logs web UI with Sigma support#2939kevoreilly merged 6 commits intokevoreilly:masterfrom
Conversation
… logs The Windows analyzer logs the package selection as: INFO: analysis package selected: "pkg" but get_package() only searched for the Linux format: INFO: Automatically selected analysis package "pkg" This caused the package field to remain empty in reports for Windows analyses where no package was explicitly specified. Now searches for both log formats using len(marker) instead of a hardcoded offset.
Enhanced evtx.py auxiliary module: - Collect 20+ additional Windows event log channels (PowerShell, Defender, BITS, Firewall, NTLM, AppLocker, WMI, Task Scheduler, etc.) - Enable command line logging (ProcessCreationIncludeCmdLine_Enabled) - Configure log sizes (100MB per channel) - Use audit policy GUIDs instead of English names (non-English support) - Quote channel names in wevtutil calls New event logs web UI: - Three-tab layout: Sigma Detections, Sysmon Events, EVTX Events - Sigma tab shows rule title, severity, ID, description, matched events - Sigma query shown on expand (not cluttering collapsed view) - Severity badge coloring (critical/high/medium/low/informational) - MITRE ATT&CK technique display per detection Systemd units for daily Sigma rule updates via Zircolite. Companion to CAPESandbox/community#544 which adds the sigma processing module and behavioral signature.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the platform's capability to collect and analyze Windows event logs, providing deeper insights into system activities. It introduces a comprehensive set of new event log channels for collection and a user-friendly web interface to visualize and interact with these logs, including Sigma detections and Sysmon events. These changes aim to improve threat detection and analysis by offering more granular data and a streamlined review process. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request significantly enhances the EVTX log collection capabilities and introduces a new web UI for viewing event logs, including Sysmon events and Sigma detections, with improvements like using GUIDs for audit policies and on-demand UI loading. However, a significant DOM-based Cross-Site Scripting (XSS) vulnerability was identified in the Sysmon Events tab of the new web UI, stemming from the direct concatenation of unescaped Event IDs into the HTML structure via JavaScript. Additionally, feedback includes reducing code duplication in the evtx.py module and making the systemd service for Sigma updates more robust by not ignoring restart failures.
| tabsHtml += '<li class="nav-item"><a class="nav-link' + active + '" data-bs-toggle="tab" href="#sysmon_eid_' + eid + '" role="tab">' + | ||
| getEventName(eid) + ' (' + grouped[eid].length + ')</a></li>'; |
There was a problem hiding this comment.
The eid (Event ID) variable, which is extracted from attacker-controlled Sysmon logs, is concatenated directly into HTML strings without proper escaping. This allows for DOM-based Cross-Site Scripting (XSS). An attacker can craft a malicious EVTX file or trigger malware to generate a Sysmon event with a specially crafted EventID containing HTML/JavaScript, which will be executed in the context of the user's browser when they view the Sysmon Events tab.
To remediate this, use the escapeHtml() function to sanitize the eid variable and the return value of getEventName(eid) before concatenating them into HTML strings.
tabsHtml += '<li class="nav-item"><a class="nav-link' + active + '" data-bs-toggle="tab" href="#sysmon_eid_' + escapeHtml(eid) + '" role="tab">' +
escapeHtml(getEventName(eid)) + ' (' + grouped[eid].length + ')</a></li>';
There was a problem hiding this comment.
Fixed in f9988b8 — applied escapeHtml() to all eid insertions and getEventName(eid) return value.
| var events = grouped[eid]; | ||
| var showActive = j === 0 ? " show active" : ""; | ||
|
|
||
| contentHtml += '<div class="tab-pane fade' + showActive + '" id="sysmon_eid_' + eid + '">'; |
There was a problem hiding this comment.
The eid variable is used here without escaping, contributing to the DOM XSS vulnerability.
contentHtml += '<div class="tab-pane fade' + showActive + '" id="sysmon_eid_' + escapeHtml(eid) + '">';
There was a problem hiding this comment.
Fixed in f9988b8 — applied escapeHtml() to all eid insertions and getEventName(eid) return value.
| var evt = events[e]; | ||
| var pageNum = Math.floor(e / PAGE_SIZE) + 1; | ||
| var hidden = pageNum > 1 ? ' style="display:none"' : ''; | ||
| contentHtml += '<tr class="sysmon-row" data-page="' + pageNum + '" data-eid="' + eid + '"' + hidden + '>'; |
There was a problem hiding this comment.
The eid variable is used here without escaping, contributing to the DOM XSS vulnerability.
contentHtml += '<tr class="sysmon-row" data-page="' + pageNum + '" data-eid="' + escapeHtml(eid) + '"' + hidden + '>';
There was a problem hiding this comment.
Fixed in f9988b8 — applied escapeHtml() to all eid insertions and getEventName(eid) return value.
|
|
||
| // Pagination controls | ||
| if (totalPages > 1) { | ||
| contentHtml += '<nav aria-label="Sysmon pagination"><ul class="pagination justify-content-center eventlogs-pagination" data-eid="' + eid + '">'; |
There was a problem hiding this comment.
The eid variable is used here without escaping, contributing to the DOM XSS vulnerability.
contentHtml += '<nav aria-label="Sysmon pagination"><ul class="pagination justify-content-center eventlogs-pagination" data-eid="' + escapeHtml(eid) + '">';
There was a problem hiding this comment.
Fixed in f9988b8 — applied escapeHtml() to all eid insertions and getEventName(eid) return value.
| log_sizes = [ | ||
| "Security", | ||
| "Microsoft-Windows-PowerShell/Operational", | ||
| "Windows PowerShell", | ||
| "PowerShellCore/Operational", | ||
| "System", | ||
| "Application", | ||
| "Microsoft-Windows-Windows Defender/Operational", | ||
| "Microsoft-Windows-Bits-Client/Operational", | ||
| "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall", | ||
| "Microsoft-Windows-NTLM/Operational", | ||
| "Microsoft-Windows-Security-Mitigations/KernelMode", | ||
| "Microsoft-Windows-Security-Mitigations/UserMode", | ||
| "Microsoft-Windows-PrintService/Admin", | ||
| "Microsoft-Windows-PrintService/Operational", | ||
| "Microsoft-Windows-SmbClient/Security", | ||
| "Microsoft-Windows-AppLocker/MSI and Script", | ||
| "Microsoft-Windows-AppLocker/EXE and DLL", | ||
| "Microsoft-Windows-AppLocker/Packaged app-Deployment", | ||
| "Microsoft-Windows-AppLocker/Packaged app-Execution", | ||
| "Microsoft-Windows-CodeIntegrity/Operational", | ||
| "Microsoft-Windows-Diagnosis-Scripted/Operational", | ||
| "Microsoft-Windows-DriverFrameworks-UserMode/Operational", | ||
| "Microsoft-Windows-WMI-Activity/Operational", | ||
| "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", | ||
| "Microsoft-Windows-TaskScheduler/Operational", | ||
| ] |
There was a problem hiding this comment.
There is significant duplication between the log_sizes list and the windows_logs list defined earlier in this file. This makes the code harder to maintain, as adding a new log channel to be collected might require adding it in two places.
To improve maintainability, consider defining log_sizes by filtering windows_logs instead of duplicating the entries. For example:
# Logs that should not have their size configured
logs_to_exclude_from_sizing = {
"HardwareEvents",
"Internet Explorer",
"Key Management Service",
"OAlerts",
"Setup",
"Microsoft-Windows-Sysmon/Operational",
}
# All channels get the same max size for sandbox use
log_sizes = [log for log in windows_logs if log not in logs_to_exclude_from_sizing]There was a problem hiding this comment.
Won't fix — log_sizes is intentionally a subset of windows_logs. Not all channels need size configuration (e.g. some are low-volume and the default size is fine). Merging the two would either over-configure small channels or require a more complex data structure for no real benefit.
| WorkingDirectory=/opt/zircolite | ||
| ExecStart=/etc/poetry/bin/poetry --directory /opt/CAPEv2/ run python zircolite.py --update-rules | ||
| ExecStartPost=/bin/bash -c 'for f in /opt/zircolite/rules/*.json; do dest="/opt/CAPEv2/data/sigma/$(basename "$f")"; [ -f "$dest" ] && cp "$f" "$dest"; done' | ||
| ExecStartPost=+/bin/systemctl restart cape-processor.service |
There was a problem hiding this comment.
The + prefix on this ExecStartPost command causes systemd to ignore any failures when restarting the cape-processor.service. If the service fails to restart, the new Sigma rules won't be loaded, but this update job will still be marked as successful. This can lead to a silent failure. For better operational robustness, it's recommended to remove the + so that a restart failure causes this service unit to enter a failed state, which can then be detected by monitoring systems.
ExecStartPost=/bin/systemctl restart cape-processor.service
There was a problem hiding this comment.
The + prefix is not for ignoring errors — it causes systemd to run that specific ExecStartPost command with full root privileges regardless of the User=cape directive. This is necessary because an unprivileged user cannot restart system services. See systemd.exec(5): "If the executable path is prefixed with '+', the process is executed with full privileges."
Event IDs from untrusted guest Sysmon logs were concatenated into HTML without escaping. Apply escapeHtml() to all eid insertions.
Remove warning log for suspicious EVTX archive members.
2 participants
Summary
evtx.pyauxiliary module with 20+ additional Windows event log channels (PowerShell, Defender, BITS, Firewall, NTLM, AppLocker, WMI, Task Scheduler, etc.), command line logging, configurable log sizes, audit policy GUIDs for non-English Windows supportDependencies