Workflow Test Reports Invalid JSON

InsightConnect
,
1

I have a very basic workflow that I am trying to create as I am just starting out learning how develop workflows. My workflow uses an RSS connector for lolbas json feed. The connector passed testing when I created it.

So far my workflow has a trigger and an artifact that hopefully will output the results so I can figure out how to parse them. However, when use the test feature in the workflow and paste the json from https://lolbas-project.github.io/api/lolbas.json into the prompt I get a message stating “Invalid JSON syntax used for object input.” I even attempted to run the workflow manually and paste in the same JSON from the website and I get the same error message.

The workflow is based on the simple workflow found at Triggers in InsightConnect.

I think my workflow is setup correctly, but I am on day 3 of trying to figure out how to develop workflows and I am not sure where to look to figure out why I am getting that error message. The google oracle did not provide meaningful answers.

2

The output that you shared from lolbas-project is an array of objects. The RSS plugin expects an object as input. You can use this as test input for you RSS Feed. It is just the first object from that array.

{“Name”:“AddinUtil.exe”,“Description”:“.NET Tool used for updating cache files for Microsoft Office Add-Ins.”,“Author”:“Michael McKinley @MckinleyMike”,“Created”:“2023-10-05”,“Commands”:[{“Command”:“C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.”,“Description”:“AddinUtil is executed from the directory where the ‘Addins.Store’ payload exists, AddinUtil will execute the ‘Addins.Store’ payload.”,“U{{[secase”:“Proxy execution of malicious serialized payload”,“Category”:“Execute”,“Privileges”:“User”,“MitreID”:“T1218”,“OperatingSystem”:“Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11”}],“Full_Path”:[{“Path”:“C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe”},{“Path”:“C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe”}],“Detection”:[{“Sigma”:“https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml"},{“Sigma”:“https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml”},{“Sigma”:“https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml”},{“Sigma”:“https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml”}],“Resources”:[{“Link”:“https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html”}],“url”:"https://lolbas-project.github.io/lolbas/Binaries/Addinutil/”}

3

Still got the same error message:
When I select run from the list of workflows:
error_two_run_option_workflow_list

When I am in the editor and select the test option:
error_one_while_in_workflow

Maybe it is how I am handling the output in the artifact? This is my entire workflow:
image

4

I figured out what the issue, there was a an extra space. Once I removed it the tests ran.

Thanks!