From b3e8c729ec66f5e082f3ed697cb77e7170b928b0 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 31 Mar 2023 12:07:36 -0600 Subject: [PATCH 1/3] 3CX - CVE-2023-29059 --- detections/endpoint/hunting_3cxdesktopapp_software.yml | 2 ++ detections/endpoint/windows_vulnerable_3cx_software.yml | 2 ++ .../network/3cx_supply_chain_attack_network_indicators.yml | 2 ++ stories/3cx_supply_chain_attack.yml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml index c62351c051..222d705591 100644 --- a/detections/endpoint/hunting_3cxdesktopapp_software.yml +++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml @@ -31,6 +31,8 @@ tags: - CIS 5 - CIS 16 confidence: 50 + cve: + - CVE-2023-29059 context: - Source:Endpoint - Stage:Execution diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml index efea7e4664..961bd9c285 100644 --- a/detections/endpoint/windows_vulnerable_3cx_software.yml +++ b/detections/endpoint/windows_vulnerable_3cx_software.yml @@ -31,6 +31,8 @@ tags: - CIS 5 - CIS 16 confidence: 90 + cve: + - CVE-2023-29059 context: - Source:Endpoint - Stage:Execution diff --git a/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml b/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml index 0003fb7371..98499a303b 100644 --- a/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml @@ -31,6 +31,8 @@ tags: - CIS 5 - CIS 16 confidence: 100 + cve: + - CVE-2023-29059 context: - Scope:Network dataset: diff --git a/stories/3cx_supply_chain_attack.yml b/stories/3cx_supply_chain_attack.yml index 537d3880ef..fae44ccf52 100644 --- a/stories/3cx_supply_chain_attack.yml +++ b/stories/3cx_supply_chain_attack.yml @@ -15,6 +15,8 @@ references: - https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/ tags: analytic_story: 3CX Supply Chain Attack + cve: + - CVE-2023-29059 category: - Adversary Tactics product: From 6af2737989cfbe43bd56961b9652f9ffe2a0b530 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Apr 2023 23:56:59 +0000 Subject: [PATCH 2/3] Bump pydantic from 1.10.5 to 1.10.7 Bumps [pydantic](https://github.com/pydantic/pydantic) from 1.10.5 to 1.10.7. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/v1.10.7/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/compare/v1.10.5...v1.10.7) --- updated-dependencies: - dependency-name: pydantic dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 23bf31c951..5d6f592a59 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ jsonschema==4.17.3 mock==4.0.3 psutil==5.9.4 pycvesearch==1.2 -pydantic==1.10.5 +pydantic==1.10.7 pytest==7.2.1 PyYAML==5.4.1 questionary==1.10.0 From 6f799fce533571c7f12ecfad8c2a5957bb3dbfe2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Apr 2023 23:57:04 +0000 Subject: [PATCH 3/3] Bump splunk-appinspect from 2.33.0 to 2.34.0 Bumps [splunk-appinspect](https://splunk.com) from 2.33.0 to 2.34.0. --- updated-dependencies: - dependency-name: splunk-appinspect dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 23bf31c951..7f8984942f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12,7 +12,7 @@ PyYAML==5.4.1 questionary==1.10.0 requests==2.28.2 six==1.16.0 -splunk-appinspect==2.33.0 +splunk-appinspect==2.34.0 splunk-sdk==1.7.3 wrapt-timeout-decorator==1.3.12.2 xmltodict==0.13.0