diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index b3ef7e14ee..dd6c26029f 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,13 +18,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} - else - echo "Installing latest contentctl version" - pip install contentctl - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti @@ -46,4 +41,4 @@ jobs: name: content-latest path: | artifacts/DA-ESS-ContentUpdate-latest.tar.gz - artifacts/app_inspect_report + artifacts/app_inspect_report \ No newline at end of file diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e381aad16d..c0b0be2759 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,13 +19,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} - else - echo "Installing latest contentctl version" - pip install contentctl - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 73fd02912e..c2587ec892 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -24,7 +24,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install "contentctl>=4.0.0" + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt - name: Run ContentCTL Data source TA validation id: validate diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 659db6358f..761e9f3c73 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,13 +23,9 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} - else - echo "Installing latest contentctl version" - pip install contentctl - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt + # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork @@ -69,4 +65,4 @@ jobs: run: | echo "This job will fail if there are failures in unit-testing" python .github/workflows/format_test_results.py >> $GITHUB_STEP_SUMMARY - echo "The Unit testing is completed. See details in the unit-testing job summary UI " + echo "The Unit testing is completed. See details in the unit-testing job summary UI " \ No newline at end of file diff --git a/contentctl.yml b/contentctl.yml index f7279408a2..e7b7d87399 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.5.0 + version: 5.6.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 4850d08ce0..c889886fb8 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -1,7 +1,7 @@ name: Fsutil Zeroing File id: 4e5e024e-fabb-11eb-8b8f-acde48001122 -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-05-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -19,7 +19,7 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe Processes.process="*setzerodata*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec diff --git a/detections/deprecated/detect_large_outbound_icmp_packets.yml b/removed/detections/detect_large_outbound_icmp_packets.yml similarity index 99% rename from detections/deprecated/detect_large_outbound_icmp_packets.yml rename to removed/detections/detect_large_outbound_icmp_packets.yml index f62ff92dd6..368364f408 100644 --- a/detections/deprecated/detect_large_outbound_icmp_packets.yml +++ b/removed/detections/detect_large_outbound_icmp_packets.yml @@ -3,7 +3,7 @@ id: e9c102de-4d43-42a7-b1c8-8062ea297419 version: 12 date: '2025-05-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This analytic has been deprecated in favour of a better named detection - Detect Large ICMP Traffic. The following analytic identifies outbound ICMP packets with a size larger than 1,000 bytes. It leverages the Network_Traffic data model to detect unusually diff --git a/detections/deprecated/windows_service_created_within_public_path.yml b/removed/detections/windows_service_created_within_public_path.yml similarity index 99% rename from detections/deprecated/windows_service_created_within_public_path.yml rename to removed/detections/windows_service_created_within_public_path.yml index f0385afc18..3dce0c89d4 100644 --- a/detections/deprecated/windows_service_created_within_public_path.yml +++ b/removed/detections/windows_service_created_within_public_path.yml @@ -3,7 +3,7 @@ id: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af version: 9 date: '2025-05-02' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: This analytic is deprecated because it is a duplicate of - "Windows Service Created with Suspicious Service Path". The following analytic detects the creation of a Windows Service with diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000000..7453e526b3 --- /dev/null +++ b/requirements.txt @@ -0,0 +1 @@ +contentctl==5.5.1 \ No newline at end of file