New script for command line analysis (demisto#37611)

* new script * new script * fix script name * fix script name * update RN * added script outputs * added script outputs * fix the script description * updated readme * updated docker image * Import "CommandLineAnalysis" instead of "your_script" in UT file * Implement pre-commit's auto-fixable issues * review updates * review updates * review updates * review updates * review updates * review updates * review updates * Update Packs/CommonScripts/Scripts/CommandLineAnalysis/CommandLineAnalysis.yml Co-authored-by: samuelFain <[email protected]> * review updates * review updates * fix assertion errors * bug fix in clean_non_base64_chars and in isBase64 functions * Bump pack from version CommonScripts to 1.18.1. * bug fix in clean_non_base64_chars and in isBase64 functions * Replace `print` with `LOG` * ruff auto fixes * bug fix in clean_non_base64_chars and in isBase64 functions * bug fix in clean_non_base64_chars and in isBase64 functions * fix imports * Bump pack from version CommonScripts to 1.18.2. * fix imports * fix imports * fix imports * fix imports * fix imports * fix imports * fix imports * fix imports * fix imports * update RN * update RN * pycln and autopep8 fixes * fix an issue with detecting Base64 * Bump pack from version CommonScripts to 1.18.4. * update RN * Bump pack from version CommonScripts to 1.18.5. * update RN * pre-commit auto-fixes --------- Co-authored-by: Erez FelmanDar <[email protected]> Co-authored-by: samuelFain <[email protected]> Co-authored-by: Content Bot <[email protected]>
metron-labs · Dec 19, 2024 · a3cc7c9 · a3cc7c9
1 parent 083f2cc
commit a3cc7c9
Show file tree

Hide file tree

Showing 6 changed files with 1,027 additions and 1 deletion.
diff --git a/Packs/CommonScripts/ReleaseNotes/1_18_5.md b/Packs/CommonScripts/ReleaseNotes/1_18_5.md
@@ -0,0 +1,13 @@
+
+#### Scripts
+
+##### New: CommandLineAnalysis
+
+- New: This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:
+
+* 0-25: Low Risk
+* 26-50: Medium Risk
+* 51-90: High Risk
+* 91-100: Critical Risk
+
+The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.