Merge branch 'develop' into issue_1557_bug_with_lnk_file

.github/workflows/auto-merge.yml

@@ -1,12 +1,13 @@
 name: auto-merge
-
 on:
-  pull_request:
+  pull_request_target:
 
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v2
       - uses: ahmadnassri/action-dependabot-auto-merge@v2
         with:
+          target: minor
           github-token: ${{ secrets.AUTOMERGE }}

.github/workflows/build-and-validate.yml

@@ -13,7 +13,10 @@
 
 
 name: build-and-validate
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
   validate-tag-if-present:
     runs-on: ubuntu-latest

.github/workflows/detection-testing.yml

@@ -1,5 +1,8 @@
 name: detection-testing
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
 
   validate-tag-if-present:
@@ -30,16 +33,20 @@ jobs:
       runs-on: ubuntu-latest
       environment: Detection-Testing-Approval
       needs: [validate-tag-if-present]
-      #Only run when we are pushing to the head of a branch or on a PR.
-      #This implicitly means that we do not run on a tag
-      if: startsWith(github.ref, 'refs/heads/')  || startsWith(github.ref, 'refs/pull/')
       steps:  
 
           - name: Checkout Repo
             uses: actions/checkout@v2
-            with:
-              ref: 'develop'
           
+
+          #The following branch name only works (and is only used) for a push
+          #to a branch. We used a different method for getting the source branch
+          #from a PR
+          - name: Get branch and PR required for detection testing main.py
+            id: vars
+            run: |
+              echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
+
           - name: Install System Packages
             run: | 
               sudo apt update -qq
@@ -58,10 +65,6 @@ jobs:
               source venv/bin/activate
               python3 -m pip install -q -r requirements.txt
           
-          - name: Get branch and PR required for detection testing main.py
-            id: vars
-            run: |
-              echo ::set-output name=tag::${GITHUB_REF#refs/tags/}
               
           #Set up credentials in the environment so that boto will be able to find them
           - uses: aws-actions/configure-aws-credentials@v1
@@ -80,9 +83,15 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.issue.number }}" ]]; then
-                  python3 main.py -b develop -pr ${{ github.event.issue.number }}
-                
+              echo "github.event.issue.pull_request    : [${{ github.event.issue.pull_request }}]"
+              echo "github.event.pull_request.number   : [${{ github.event.pull_request.number }}]"
+              echo "steps.vars.outputs.branch          : [${{ steps.vars.outputs.branch }}]"
+              echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
+
+              if [[ ! -z "${{  github.event.pull_request.head.ref }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
+                echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
+                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
-                  python3 main.py -b develop
+                echo "Push from branch [${{ steps.vars.outputs.branch }}]"
+                python3 main.py -b ${{ steps.vars.outputs.branch }}
               fi

.github/workflows/semgrep-analysis.yml

@@ -5,7 +5,10 @@
 
 name: Semgrep
 
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
 
   validate-tag-if-present:

README.md

@@ -22,7 +22,7 @@
 
 Welcome to the Splunk Security Content
 
-This project gives you access to our repository of Analytic Stories, security guides that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
+This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
 
 # Get Content🛡
 The latest Splunk Security Content can be obtained via:

bin/generate.py

@@ -361,7 +361,7 @@ def add_rba(detection):
             if entity['type'].lower() in risk_object_user_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
 
                         risk_object['risk_object_type'] = 'user'
                         risk_object['risk_object_field'] = entity['name']
@@ -373,7 +373,7 @@ def add_rba(detection):
             elif entity['type'].lower() in risk_object_system_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
                         
                         risk_object['risk_object_type'] = 'system'
                         risk_object['risk_object_field'] = entity['name']

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -1,18 +1,17 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 4
-date: '2020-07-21'
+version: 5
+date: '2021-08-29'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This search looks for the creation of local administrator accounts using
-  net.exe.
+  net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
-  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add*
-  OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest
+  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   |`create_local_admin_accounts_using_net_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your

detections/endpoint/disable_registry_tool.yml

@@ -29,8 +29,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -38,9 +38,14 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled Registry Tools
+  message: Disabled Registry Tools on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/disable_show_hidden_files.yml

@@ -31,8 +31,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -40,10 +40,15 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Show Hidden Files'
+  message: Disabled 'Show Hidden Files' on $dest$
   mitre_attack_id:
   - T1564.001
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -33,16 +33,21 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Windows App Hotkeys'
+  message: Disabled 'Windows App Hotkeys' on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/start_up_during_safe_mode_boot.yml

@@ -37,10 +37,15 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: Safeboot registry $Registry.registry_path$ was added or modified with a
-    new value $Registry.registry_value_name$
+  message: Safeboot registry $registry_path$ was added or modified with a
+    new value $registry_value_name$ on $dest$
   mitre_attack_id:
   - T1547.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security