From 69e989421934501141886b93a9930cba2d3ae295 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 13:01:59 -0700 Subject: [PATCH 01/13] adding missing filter --- detections/endpoint/fsutil_zeroing_file.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 4850d08ce0..c9b8939ff0 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -19,7 +19,7 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe Processes.process="*setzerodata*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec From fb954bc403a8172b2ea0153a0be7546b5610d8c1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 13:03:10 -0700 Subject: [PATCH 02/13] updating detections --- detections/endpoint/fsutil_zeroing_file.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index c9b8939ff0..c889886fb8 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -1,7 +1,7 @@ name: Fsutil Zeroing File id: 4e5e024e-fabb-11eb-8b8f-acde48001122 -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-05-08' author: Teoderick Contreras, Splunk status: production type: TTP From b31fe1ee92086a901157fe374b5f34ab2aba27b8 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 13:41:03 -0700 Subject: [PATCH 03/13] updating contntctl.yml --- contentctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.yml b/contentctl.yml index 04b58a2621..2b3d3d981d 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.5.0 + version: 5.6.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 23d0f236b5b1096501e6d4ce32e9d4d955b86b94 Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Thu, 8 May 2025 14:52:52 -0700 Subject: [PATCH 04/13] Move deprecated detections to removed. update status too --- .../detections}/detect_large_outbound_icmp_packets.yml | 2 +- .../detections}/windows_service_created_within_public_path.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename {detections/deprecated => removed/detections}/detect_large_outbound_icmp_packets.yml (99%) rename {detections/deprecated => removed/detections}/windows_service_created_within_public_path.yml (99%) diff --git a/detections/deprecated/detect_large_outbound_icmp_packets.yml b/removed/detections/detect_large_outbound_icmp_packets.yml similarity index 99% rename from detections/deprecated/detect_large_outbound_icmp_packets.yml rename to removed/detections/detect_large_outbound_icmp_packets.yml index f62ff92dd6..368364f408 100644 --- a/detections/deprecated/detect_large_outbound_icmp_packets.yml +++ b/removed/detections/detect_large_outbound_icmp_packets.yml @@ -3,7 +3,7 @@ id: e9c102de-4d43-42a7-b1c8-8062ea297419 version: 12 date: '2025-05-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This analytic has been deprecated in favour of a better named detection - Detect Large ICMP Traffic. The following analytic identifies outbound ICMP packets with a size larger than 1,000 bytes. It leverages the Network_Traffic data model to detect unusually diff --git a/detections/deprecated/windows_service_created_within_public_path.yml b/removed/detections/windows_service_created_within_public_path.yml similarity index 99% rename from detections/deprecated/windows_service_created_within_public_path.yml rename to removed/detections/windows_service_created_within_public_path.yml index f0385afc18..3dce0c89d4 100644 --- a/detections/deprecated/windows_service_created_within_public_path.yml +++ b/removed/detections/windows_service_created_within_public_path.yml @@ -3,7 +3,7 @@ id: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af version: 9 date: '2025-05-02' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: This analytic is deprecated because it is a duplicate of - "Windows Service Created with Suspicious Service Path". The following analytic detects the creation of a Windows Service with From ebecdfd8a409dc3db4df5c436785402668052849 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:05:07 -0700 Subject: [PATCH 05/13] adding requirements.txt --- .github/workflows/appinspect.yml | 4 ++-- .github/workflows/build.yml | 4 ++-- .github/workflows/datasource-dependabot.yml | 2 +- .github/workflows/unit-testing.yml | 4 ++-- requirements.txt | 1 + 5 files changed, 8 insertions(+), 7 deletions(-) create mode 100644 requirements.txt diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index b3ef7e14ee..467d483743 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -20,10 +20,10 @@ jobs: run: | if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} + pip install -r requirements.txt else echo "Installing latest contentctl version" - pip install contentctl + pip install -r requirements.txt fi git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e381aad16d..f0b2a059f1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,10 +21,10 @@ jobs: run: | if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} + pip install -r requirements.txt else echo "Installing latest contentctl version" - pip install contentctl + pip install -r requirements.txt fi git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 73fd02912e..d5dbe82538 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -24,7 +24,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install "contentctl>=4.0.0" + pip install -r requirements.txt - name: Run ContentCTL Data source TA validation id: validate diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 659db6358f..58c4965837 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -25,10 +25,10 @@ jobs: python -m pip install --upgrade pip if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} + pip install -r requirements.txt else echo "Installing latest contentctl version" - pip install contentctl + pip install -r requirements.txt fi # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000000..7453e526b3 --- /dev/null +++ b/requirements.txt @@ -0,0 +1 @@ +contentctl==5.5.1 \ No newline at end of file From 332e0d1047dacba7e341828290115e8932ebb6e6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:09:43 -0700 Subject: [PATCH 06/13] updating commands to install contentctl --- .github/workflows/appinspect.yml | 8 ++------ .github/workflows/build.yml | 9 ++------- .github/workflows/datasource-dependabot.yml | 1 + .github/workflows/unit-testing.yml | 9 ++------- 4 files changed, 7 insertions(+), 20 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 467d483743..bee03e9d86 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,12 +18,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install -r requirements.txt - else - echo "Installing latest contentctl version" - pip install -r requirements.txt + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt fi git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f0b2a059f1..c0b0be2759 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,13 +19,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install -r requirements.txt - else - echo "Installing latest contentctl version" - pip install -r requirements.txt - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index d5dbe82538..c2587ec892 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -24,6 +24,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | + echo "- Contentctl version - $(cat requirements.txt)" pip install -r requirements.txt - name: Run ContentCTL Data source TA validation diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 58c4965837..7a1ed25ebb 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,13 +23,8 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install -r requirements.txt - else - echo "Installing latest contentctl version" - pip install -r requirements.txt - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From 9b765275e3411d550a149615e37aadc09ce52594 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:15:40 -0700 Subject: [PATCH 07/13] test --- .github/workflows/unit-testing.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 7a1ed25ebb..33cee4c252 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,6 +23,8 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip + pwd + ls -la echo "- Contentctl version - $(cat requirements.txt)" pip install -r requirements.txt From 52f6703ade99a7da318a0dfb26c42fb6b61838c1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:16:45 -0700 Subject: [PATCH 08/13] testing pwd --- .github/workflows/unit-testing.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 33cee4c252..761739d39c 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,8 +23,8 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pwd ls -la + pwd echo "- Contentctl version - $(cat requirements.txt)" pip install -r requirements.txt From 0db01e7bfc13b9a8e6f10bc0394d6d35c6ee8d77 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:19:17 -0700 Subject: [PATCH 09/13] updating test job --- .github/workflows/unit-testing.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 761739d39c..5dcdafddf7 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,10 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - ls -la - pwd - echo "- Contentctl version - $(cat requirements.txt)" - pip install -r requirements.txt + pip install contentctl # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From 45a08029dfcc297f607d1f40564f175efed17bd0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:22:58 -0700 Subject: [PATCH 10/13] revert in all other jobs but build --- .github/workflows/appinspect.yml | 10 +++++++--- .github/workflows/datasource-dependabot.yml | 3 +-- .github/workflows/unit-testing.yml | 10 ++++++++-- 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index bee03e9d86..c907c860bb 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,8 +18,12 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - echo "- Contentctl version - $(cat requirements.txt)" - pip install -r requirements.txt + if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then + echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} + else + echo "Installing latest contentctl version" + pip install contentctl fi git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti @@ -42,4 +46,4 @@ jobs: name: content-latest path: | artifacts/DA-ESS-ContentUpdate-latest.tar.gz - artifacts/app_inspect_report + artifacts/app_inspect_report \ No newline at end of file diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index c2587ec892..73fd02912e 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -24,8 +24,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - echo "- Contentctl version - $(cat requirements.txt)" - pip install -r requirements.txt + pip install "contentctl>=4.0.0" - name: Run ContentCTL Data source TA validation id: validate diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 5dcdafddf7..ca3433b736 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,7 +23,13 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl + if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then + echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} + else + echo "Installing latest contentctl version" + pip install contentctl + fi # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork @@ -63,4 +69,4 @@ jobs: run: | echo "This job will fail if there are failures in unit-testing" python .github/workflows/format_test_results.py >> $GITHUB_STEP_SUMMARY - echo "The Unit testing is completed. See details in the unit-testing job summary UI " + echo "The Unit testing is completed. See details in the unit-testing job summary UI " \ No newline at end of file From 5813aa38a1e3690fb54f9827c0435832ac3a7a6e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:27:19 -0700 Subject: [PATCH 11/13] remove whitespace --- .github/workflows/appinspect.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index c907c860bb..3899c06d15 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -46,4 +46,5 @@ jobs: name: content-latest path: | artifacts/DA-ESS-ContentUpdate-latest.tar.gz - artifacts/app_inspect_report \ No newline at end of file + artifacts/app_inspect_report + \ No newline at end of file From 25eb348ba5e96a19f5108b23c236426913e2f435 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:28:04 -0700 Subject: [PATCH 12/13] no new line --- .github/workflows/appinspect.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 3899c06d15..c907c860bb 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -46,5 +46,4 @@ jobs: name: content-latest path: | artifacts/DA-ESS-ContentUpdate-latest.tar.gz - artifacts/app_inspect_report - \ No newline at end of file + artifacts/app_inspect_report \ No newline at end of file From a4a90fc93db1fc4f35fdce5d61c5701469fb19f6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 8 May 2025 15:47:10 -0700 Subject: [PATCH 13/13] update install steos --- .github/workflows/appinspect.yml | 9 ++------- .github/workflows/datasource-dependabot.yml | 3 ++- .github/workflows/unit-testing.yml | 10 +++------- 3 files changed, 7 insertions(+), 15 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index c907c860bb..dd6c26029f 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,13 +18,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} - else - echo "Installing latest contentctl version" - pip install contentctl - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 73fd02912e..c2587ec892 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -24,7 +24,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install "contentctl>=4.0.0" + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt - name: Run ContentCTL Data source TA validation id: validate diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index ca3433b736..761e9f3c73 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,13 +23,9 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then - echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}" - pip install contentctl==${{ vars.CONTENTCTL_VERSION }} - else - echo "Installing latest contentctl version" - pip install contentctl - fi + echo "- Contentctl version - $(cat requirements.txt)" + pip install -r requirements.txt + # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork