From 1e6f2d79b0e98f5ebb615ac30d149a57059b7f1c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 12:48:25 -0700 Subject: [PATCH 1/6] Don't modify the original search variable. This can cause problems if we need to run the search again. --- bin/docker_detection_tester/modules/splunk_sdk.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 2dc6c36556..4e0c01a8bb 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -192,15 +192,15 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass # search = search.replace('\\','\\\\') if search.startswith('|'): - search = search + updated_search = search else: - search = 'search ' + search + updated_search = 'search ' + search kwargs = {"exec_mode": "blocking", "dispatch.earliest_time": earliest_time, "dispatch.latest_time": latest_time} - splunk_search = search + ' ' + pass_condition + splunk_search = updated_search + ' ' + pass_condition try: job = service.jobs.create(splunk_search, **kwargs) @@ -233,15 +233,15 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, attempts_remaining -= 1 if search.startswith('|'): - search = search + updated_search = search else: - search = 'search ' + search + updated_search = 'search ' + search kwargs = {"exec_mode": "blocking", "dispatch.earliest_time": "-1d", "dispatch.latest_time": "now"} - splunk_search = search + ' ' + pass_condition + splunk_search = updated_search + ' ' + pass_condition test_results = dict() #These will always be present. By default, we will say that the From ccbe770e211ea0e44668b97a7477b20d4055f960 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 12:53:51 -0700 Subject: [PATCH 2/6] Modify all tests that fail in gha but pass in local testing for easier troubleshooting. --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- .../endpoint/disable_security_logs_using_minint_registry.yml | 2 +- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- .../endpoint/enable_wdigest_uselogoncredential_registry.yml | 2 +- detections/endpoint/etw_registry_disabled.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- detections/endpoint/linux_deletion_of_init_daemon_script.yml | 2 +- detections/endpoint/linux_deletion_of_ssl_certificate.yml | 2 +- .../linux_high_frequency_of_file_deletion_in_etc_folder.yml | 2 +- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- detections/endpoint/revil_registry_entry.yml | 2 +- detections/endpoint/sdclt_uac_bypass.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 2 +- .../windows_disable_change_password_through_registry.yml | 2 +- ...indows_disable_lock_workstation_feature_through_registry.yml | 2 +- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- detections/endpoint/windows_disable_notification_center.yml | 2 +- .../windows_disable_shutdown_button_through_registry.yml | 2 +- .../windows_hide_notification_features_through_registry.yml | 2 +- .../endpoint/windows_installutil_remote_network_connection.yml | 2 +- ...windows_modify_show_compress_color_and_info_tip_registry.yml | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 86c46d70eb..84d832ffb0 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -2,7 +2,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4aace03422..c71a4169df 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -2,7 +2,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index b55567d231..f20194e2c4 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -2,7 +2,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index dcd559b377..cf59998215 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -2,7 +2,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index cfe318454b..739083e0eb 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -2,7 +2,7 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 version: 2 date: '2022-01-27' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index f6e063ff1c..69747cc199 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -2,7 +2,7 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 828b657127..3811e05899 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 56af0e84d8..16df2a4524 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -2,7 +2,7 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 7948f3ac6b..78c9f29b51 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index cee914c96d..828c6b477a 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -2,7 +2,7 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index f90ac8ec8b..6cfaea1834 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -2,7 +2,7 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 0a1cf8a04a..1e2e8622bd 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -2,7 +2,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 5028c90de0..484eb2eff5 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -2,7 +2,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk +author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index e0ae661df2..0318c8cc24 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -2,7 +2,7 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 version: 2 date: '2021-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 6e0bfbad04..b07341e7e5 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -2,7 +2,7 @@ name: Sdclt UAC Bypass id: d71efbf6-da63-11eb-8c6e-acde48001122 version: 2 date: '2020-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 344ea9a9db..8ecf2b571f 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -2,7 +2,7 @@ name: SearchProtocolHost with no Command Line with Network id: b690df8c-a145-11eb-a38b-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index a371b5cff6..403ece237d 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index eaf42461b5..b940ece67a 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 2762afa09d..47cd1bc6ea 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -2,7 +2,7 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 version: 1 date: '2022-02-25' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b5e0d89819..d629aa56d5 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 1 date: '2022-02-17' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 835040e6b0..af7553c113 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 6f5e2c783a..23ea3edaa3 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index dffd5a950f..ca2d10e1fa 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 version: 2 date: '2022-03-16' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index c7538027c5..4312501bcd 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint From 71b7c5d45cbb46a0518b47047faba5ce3f706711 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 14:06:01 -0700 Subject: [PATCH 3/6] Forgot to specify the host that data was being uploaded from. This means that delete does not work as expected, causing a large number of tests to fail and slower searches. --- bin/docker_detection_tester/modules/testing_service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 72b39cfc69..23a526c5fa 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -122,7 +122,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa test_index = service.indexes[data_upload_index] with open(target_file, 'rb') as target: - test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source']) + test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source'], host=splunk_sdk.DEFAULT_EVENT_HOST) except http.client.HTTPException as e: raise(Exception(f"Failed to submit detection file {target_file} to Splunk Server: {str(e)}")) From d8458b882ec6a460c374e27689c7f2e07b16a212 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 11 Jul 2022 14:31:02 -0700 Subject: [PATCH 4/6] Quick hack to get everything tested in GHA using this verison of the CI/CD code. --- .github/workflows/detection-testing.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index a2bba1b154..1526997a74 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -79,7 +79,7 @@ jobs: echo "github.event_name : [${{ github.event_name }}]" - if [[ ${{ github.event_name }} == schedule ]]; then + if [[ ${{ github.event_name }} == schedule ]] || [[ true = true ]]; then # Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches! echo "Running a nightly test on all detections OR a commit was made directly to develop" python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json @@ -140,7 +140,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 with: - ref: develop + ref: resolve_local_gha_delta - name: Download artifacts uses: actions/download-artifact@v2 From bf127dc0c0604c4d69e24f5d38cbc48a63d06847 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 12 Jul 2022 08:39:08 -0700 Subject: [PATCH 5/6] Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works. --- .../authorize.conf.tar | Bin 2048 -> 2048 bytes .../modules/splunk_sdk.py | 43 +++--------------- 2 files changed, 7 insertions(+), 36 deletions(-) diff --git a/bin/docker_detection_tester/authorize.conf.tar b/bin/docker_detection_tester/authorize.conf.tar index 3a624a3b27a8fc5451df076403d5db682ca9c90e..a525572e5ba253077e89f845ae279d9d9eadd1b7 100644 GIT binary patch delta 84 zcmZn=Xb_lCp=w~Dz+eCc#>R#Uh9*X4#)if~(oDg?(A2=xj6uO*aw22OWJX2}*7A(h h)SQWe(wjXQ?HSopQgc#EQYYs!c`Tq0KNGW5C8xG diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 4e0c01a8bb..f930e7531b 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -317,6 +317,12 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, indices:list[str]=[DEFAULT_DATA_INDEX], host:str=DEFAULT_EVENT_HOST)->bool: + if wait_on_delete: + print(wait_on_delete['message']) + print("FILENAME : [%s]"%(detection_filename)) + print("SEARCH :\n%s"%(search_string)) + _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n") + try: service = client.connect( host=splunk_host, @@ -329,21 +335,11 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa raise(Exception("Unable to connect to Splunk instance: " + str(e))) - #splunk_search = 'search index=test* | delete' - if wait_on_delete: - print(wait_on_delete['message']) - print("FILENAME : [%s]"%(detection_filename)) - print("SEARCH :\n%s"%(search_string)) - _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n") - - data_exists = True - #print(f"Deleting data for {detection_filename}: {indices}") for index in indices: while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) : splunk_search = f'search index="{index}" host="{host}" | delete' - kwargs = { "exec_mode": "blocking", "dispatch.earliest_time": "-1d", @@ -353,34 +349,9 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa job = service.jobs.create(splunk_search, **kwargs) reader = results.ResultsReader(job) - - ''' - error_in_results = False - for result in reader: - if hasattr(result,"message") and hasattr(result,"type") and ("You have insufficient privileges to delete events" in result.message or result.type == "FATAL"): - print("Delete is not enabled for admin: [%s] - enabling delete and trying to delete again..."%(result.message), file=sys.stderr) - if already_enabled_delete is True: - print("We already enabled delete, but the setting did not take effect.") - raise(Exception("Enabling delete command failed to take effect")) - if enable_delete_for_admin(splunk_host, splunk_port,splunk_password) != True: - raise(Exception("Failure enabling delete for admin. We cannot continue")) - # We enabled delete, so now we will try to delete again - already_enabled_delete = True - break - else: - #This is not one of the error messages, do nothing - pass - ''' - #No need to issue Delete command again, we will now break out of the loop - #if error_in_results is False: - # data_exists = False - - #Otherwise, we will loop again except Exception as e: - print(f"Trouble deleting data from a run.... we will try again: {str(e)}") - time.sleep(5) - #raise(Exception("Unable to delete data from a run: " + str(e))) + raise(Exception(f"Trouble deleting data using the search {splunk_search}: {str(e)}")) return True From f8ac5616a0d8bba7fe03513adabe0cdb219c58b5 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 12 Jul 2022 10:08:07 -0700 Subject: [PATCH 6/6] Reverting the workflow and all of the detections that were touched to their original versions. --- .github/workflows/detection-testing.yml | 4 ++-- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- .../endpoint/disable_defender_enhanced_notification.yml | 2 +- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- .../endpoint/disable_security_logs_using_minint_registry.yml | 2 +- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- .../endpoint/enable_wdigest_uselogoncredential_registry.yml | 2 +- detections/endpoint/etw_registry_disabled.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- detections/endpoint/linux_deletion_of_init_daemon_script.yml | 2 +- detections/endpoint/linux_deletion_of_ssl_certificate.yml | 2 +- .../linux_high_frequency_of_file_deletion_in_etc_folder.yml | 2 +- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- detections/endpoint/revil_registry_entry.yml | 2 +- detections/endpoint/sdclt_uac_bypass.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 2 +- .../windows_disable_change_password_through_registry.yml | 2 +- ...dows_disable_lock_workstation_feature_through_registry.yml | 2 +- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- detections/endpoint/windows_disable_notification_center.yml | 2 +- .../windows_disable_shutdown_button_through_registry.yml | 2 +- .../windows_hide_notification_features_through_registry.yml | 2 +- .../windows_installutil_remote_network_connection.yml | 2 +- ...ndows_modify_show_compress_color_and_info_tip_registry.yml | 2 +- 25 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 1526997a74..a2bba1b154 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -79,7 +79,7 @@ jobs: echo "github.event_name : [${{ github.event_name }}]" - if [[ ${{ github.event_name }} == schedule ]] || [[ true = true ]]; then + if [[ ${{ github.event_name }} == schedule ]]; then # Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches! echo "Running a nightly test on all detections OR a commit was made directly to develop" python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json @@ -140,7 +140,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 with: - ref: resolve_local_gha_delta + ref: develop - name: Download artifacts uses: actions/download-artifact@v2 diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 84d832ffb0..86c46d70eb 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -2,7 +2,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index c71a4169df..4aace03422 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -2,7 +2,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index f20194e2c4..b55567d231 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -2,7 +2,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index cf59998215..dcd559b377 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -2,7 +2,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 version: 2 date: '2022-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 739083e0eb..cfe318454b 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -2,7 +2,7 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 version: 2 date: '2022-01-27' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 69747cc199..f6e063ff1c 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -2,7 +2,7 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 3811e05899..828b657127 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 16df2a4524..56af0e84d8 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -2,7 +2,7 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 78c9f29b51..7948f3ac6b 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 version: 2 date: '2022-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 828c6b477a..cee914c96d 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -2,7 +2,7 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 6cfaea1834..f90ac8ec8b 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -2,7 +2,7 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 1e2e8622bd..0a1cf8a04a 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -2,7 +2,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 version: 1 date: '2022-04-12' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 484eb2eff5..5028c90de0 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -2,7 +2,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk +author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 0318c8cc24..e0ae661df2 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -2,7 +2,7 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 version: 2 date: '2021-01-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index b07341e7e5..6e0bfbad04 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -2,7 +2,7 @@ name: Sdclt UAC Bypass id: d71efbf6-da63-11eb-8c6e-acde48001122 version: 2 date: '2020-01-28' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 8ecf2b571f..344ea9a9db 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -2,7 +2,7 @@ name: SearchProtocolHost with no Command Line with Network id: b690df8c-a145-11eb-a38b-acde48001122 version: 3 date: '2022-03-15' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 403ece237d..a371b5cff6 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index b940ece67a..eaf42461b5 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 47cd1bc6ea..2762afa09d 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -2,7 +2,7 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 version: 1 date: '2022-02-25' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index d629aa56d5..b5e0d89819 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 1 date: '2022-02-17' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index af7553c113..835040e6b0 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 23ea3edaa3..6f5e2c783a 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 version: 1 date: '2022-03-08' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index ca2d10e1fa..dffd5a950f 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 version: 2 date: '2022-03-16' -author: Michael Haag, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 4312501bcd..c7538027c5 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint