From 29fbc35d8b868057fcfad7706e225c9861cd0a06 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Mar 2023 00:08:11 +0000 Subject: [PATCH 1/4] Bump splunk-appinspect from 2.32.0 to 2.33.0 Bumps [splunk-appinspect](https://splunk.com) from 2.32.0 to 2.33.0. --- updated-dependencies: - dependency-name: splunk-appinspect dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 8ee8cdef0e..abcafe5ae6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12,7 +12,7 @@ PyYAML==5.4.1 questionary==1.10.0 requests==2.28.2 six==1.16.0 -splunk-appinspect==2.32.0 +splunk-appinspect==2.33.0 splunk-sdk==1.7.3 wrapt-timeout-decorator==1.3.12.2 xmltodict==0.13.0 From 0dffcb450f673133a63745aa0da129c3bc72aa61 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 2 Mar 2023 15:52:15 -0800 Subject: [PATCH 2/4] checking --- .../endpoint/linux_ssh_remote_services_script_execute.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 4a91a2e78f..6fd54ba78b 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,7 +1,7 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 version: 1 -date: '2022-07-27' +date: '2023-03-01' author: Michael Haag, Splunk type: TTP datamodel: From f891a64533d8695cfcb629f797aa205eb855b5cc Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 2 Mar 2023 16:55:23 -0800 Subject: [PATCH 3/4] update spl errror --- .../endpoint/linux_ssh_remote_services_script_execute.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 6fd54ba78b..58a16d3f0e 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies SSH being utilized to move laterally and execute a script or file on the remote host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND CommandLine IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From cdf125520ffe460434f87a42a6b2d5a8d0f63c9f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 3 Mar 2023 12:03:45 -0800 Subject: [PATCH 4/4] Updating the date of the detection and kicking off cicd again --- .../endpoint/linux_ssh_remote_services_script_execute.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 58a16d3f0e..b201e03e22 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,7 +1,7 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 version: 1 -date: '2023-03-01' +date: '2023-03-03' author: Michael Haag, Splunk type: TTP datamodel: