From e6080d9022a5590367b93b490599e8da30e20744 Mon Sep 17 00:00:00 2001
From: Rod Soto <rsoto@splunk.com>
Date: Thu, 8 Oct 2020 17:51:57 -0400
Subject: [PATCH 01/23] firstiterationgcploitdetect

---
 detections/gcp_detect_gcploit_framework.yml | 22 +++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 detections/gcp_detect_gcploit_framework.yml

diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml
new file mode 100644
index 0000000000..3cd31a4317
--- /dev/null
+++ b/detections/gcp_detect_gcploit_framework.yml
@@ -0,0 +1,22 @@
+author: "Rod Soto, Splunk"
+date: "2020-10-08"
+description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts."
+how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
+id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
+known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
+name: "gcp detect gcploit framework"
+references:
+  - https://github.com/dxa4481/gcploit
+  - https://www.youtube.com/watch?v=Ml09R38jpok
+search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`'
+tags:
+  analytics_story:
+    - "GCP Cross Account Activity"
+  asset_type: "GCP Account"
+  kill_chain_phases:
+    - Lateral Movement
+  mitre_attack_id:
+    - T1078
+  security_domain: threat
+type: ESCU
+version: 1

From e6a967a41201d4df0d5a8e922010cf999b12c480 Mon Sep 17 00:00:00 2001
From: Rod Soto <rsoto@splunk.com>
Date: Fri, 9 Oct 2020 10:07:42 -0400
Subject: [PATCH 02/23] gcpdetectaccounthighriskrolesbyproject

---
 ...counts_with_high_risk_roles_by_project.yml | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml

diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
new file mode 100644
index 0000000000..fbd6b8e278
--- /dev/null
+++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
@@ -0,0 +1,23 @@
+author: "Rod Soto, Splunk"
+date: "2020-10-09"
+description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts."
+how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
+id: 27af8c15-38b0-4408-b339-920170724adb
+known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
+name: "gcp detect accounts with high risk roles by project"
+references:
+  - https://github.com/dxa4481/gcploit
+  - https://www.youtube.com/watch?v=Ml09R38jpok
+  - https://cloud.google.com/iam/docs/understanding-roles
+search: sourcetype=google:gcp:pubsub:message "data.protoPayload.request.policy.bindings{}.role"="roles/owner" OR "roles/editor" OR "roles/iam.serviceAccountUser" OR "roles/iam.serviceAccountAdmin" OR "roles/iam.serviceAccountTokenCreator" OR "roles/dataflow.developer" OR "roles/dataflow.admin" OR "roles/composer.admin" OR "roles/dataproc.admin" OR "roles/dataproc.editor" | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`'
+tags:
+  analytics_story:
+    - "GCP Cross Account Activity"
+  asset_type: "GCP Account"
+  kill_chain_phases:
+    - Lateral Movement
+  mitre_attack_id:
+    - T1078
+  security_domain: threat
+type: ESCU
+version: 1

From 8115fbd312b8fcf604dc76d046d0a6d5722a61b6 Mon Sep 17 00:00:00 2001
From: Rod Soto <rsoto@splunk.com>
Date: Fri, 9 Oct 2020 10:12:21 -0400
Subject: [PATCH 03/23] gcpdetectaccounthighriskrolesbyproject2

---
 .../gcp_detect_accounts_with_high_risk_roles_by_project.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
index fbd6b8e278..f4e8934c6b 100644
--- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
+++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
@@ -1,9 +1,9 @@
 author: "Rod Soto, Splunk"
 date: "2020-10-09"
-description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts."
+description: "This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema."
 how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
 id: 27af8c15-38b0-4408-b339-920170724adb
-known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
+known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization"
 name: "gcp detect accounts with high risk roles by project"
 references:
   - https://github.com/dxa4481/gcploit

From cb93a1df16b4b4010b49c355405d2133ba46bdbb Mon Sep 17 00:00:00 2001
From: Rod Soto <rsoto@splunk.com>
Date: Fri, 9 Oct 2020 10:43:27 -0400
Subject: [PATCH 04/23] gcpdetecthighriskpermissionsv1

---
 ...sk_permissions_by_resource_and_account.yml | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml

diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
new file mode 100644
index 0000000000..23bf954a41
--- /dev/null
+++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
@@ -0,0 +1,23 @@
+author: "Rod Soto, Splunk"
+date: "2020-10-09"
+description: "This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges."
+how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
+id: 2e70ef35-2187-431f-aedc-4503dc9b06ba
+known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives."
+name: "gcp detect high risk permissions by resource and account"
+references:
+  - https://github.com/dxa4481/gcploit
+  - https://www.youtube.com/watch?v=Ml09R38jpok
+  - https://cloud.google.com/iam/docs/permissions-reference
+search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account`'
+tags:
+  analytics_story:
+    - "GCP Cross Account Activity"
+  asset_type: "GCP Account"
+  kill_chain_phases:
+    - Lateral Movement
+  mitre_attack_id:
+    - T1078
+  security_domain: threat
+type: ESCU
+version: 1

From 202da1aa8a92865897ac54dd62366533d348e1d1 Mon Sep 17 00:00:00 2001
From: Rod Soto <rsoto@splunk.com>
Date: Fri, 9 Oct 2020 10:57:14 -0400
Subject: [PATCH 05/23] gcpdetectsearchesfixed2

---
 .../gcp_detect_accounts_with_high_risk_roles_by_project.yml     | 2 +-
 detections/gcp_detect_gcploit_framework.yml                     | 2 +-
 ...gcp_detect_high_risk_permissions_by_resource_and_account.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
index f4e8934c6b..82265286f9 100644
--- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
+++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
@@ -9,7 +9,7 @@ references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
   - https://cloud.google.com/iam/docs/understanding-roles
-search: sourcetype=google:gcp:pubsub:message "data.protoPayload.request.policy.bindings{}.role"="roles/owner" OR "roles/editor" OR "roles/iam.serviceAccountUser" OR "roles/iam.serviceAccountAdmin" OR "roles/iam.serviceAccountTokenCreator" OR "roles/dataflow.developer" OR "roles/dataflow.admin" OR "roles/composer.admin" OR "roles/dataproc.admin" OR "roles/dataproc.editor" | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`'
+search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`
 tags:
   analytics_story:
     - "GCP Cross Account Activity"
diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml
index 3cd31a4317..9c8ce1e719 100644
--- a/detections/gcp_detect_gcploit_framework.yml
+++ b/detections/gcp_detect_gcploit_framework.yml
@@ -8,7 +8,7 @@ name: "gcp detect gcploit framework"
 references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
-search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`'
+search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`
 tags:
   analytics_story:
     - "GCP Cross Account Activity"
diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
index 23bf954a41..3f59b1da29 100644
--- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
+++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
@@ -9,7 +9,7 @@ references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
   - https://cloud.google.com/iam/docs/permissions-reference
-search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account`'
+search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account`
 tags:
   analytics_story:
     - "GCP Cross Account Activity"

From 07bae7a2b7ffd7b1f1c3340015aa009b06a3ad13 Mon Sep 17 00:00:00 2001
From: Rod Soto <rsoto@splunk.com>
Date: Fri, 9 Oct 2020 11:37:48 -0400
Subject: [PATCH 06/23] 
 ../detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml

---
 ...gcp_detect_high_risk_permissions_by_resource_and_account.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
index 3f59b1da29..d4eece9b83 100644
--- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
+++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
@@ -9,7 +9,7 @@ references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
   - https://cloud.google.com/iam/docs/permissions-reference
-search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account`
+search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account`
 tags:
   analytics_story:
     - "GCP Cross Account Activity"

From b64ca7010c24d58c8564ce4723158429c6dfa6fe Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Fri, 9 Oct 2020 10:23:53 -0700
Subject: [PATCH 07/23] seearch bugs

---
 ...detect_accounts_with_high_risk_roles_by_project.yml | 10 +++++-----
 detections/gcp_detect_gcploit_framework.yml            | 10 +++++-----
 ...t_high_risk_permissions_by_resource_and_account.yml | 10 +++++-----
 detections/gcp_detect_oauth_token_abuse.yml            |  8 ++++----
 4 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
index 82265286f9..2bf308813d 100644
--- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
+++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
@@ -4,20 +4,20 @@ description: "This search provides detection of accounts with high risk roles by
 how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
 id: 27af8c15-38b0-4408-b339-920170724adb
 known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization"
-name: "gcp detect accounts with high risk roles by project"
+name: GCP Detect accounts with high risk roles by project
 references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
   - https://cloud.google.com/iam/docs/understanding-roles
-search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`
+search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`"
 tags:
   analytics_story:
-    - "GCP Cross Account Activity"
+  - GCP Cross Account Activity
   asset_type: "GCP Account"
   kill_chain_phases:
-    - Lateral Movement
+  - Lateral Movement
   mitre_attack_id:
-    - T1078
+  - T1078
   security_domain: threat
 type: ESCU
 version: 1
diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml
index 9c8ce1e719..d247bb8014 100644
--- a/detections/gcp_detect_gcploit_framework.yml
+++ b/detections/gcp_detect_gcploit_framework.yml
@@ -4,19 +4,19 @@ description: "This search provides detection of GCPloit exploitation framework.
 how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
 id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
 known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
-name: "gcp detect gcploit framework"
+name: GCP Detect gcploit framework
 references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
-search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`
+search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`"
 tags:
   analytics_story:
-    - "GCP Cross Account Activity"
+  - GCP Cross Account Activity
   asset_type: "GCP Account"
   kill_chain_phases:
-    - Lateral Movement
+  - Lateral Movement
   mitre_attack_id:
-    - T1078
+  - T1078
   security_domain: threat
 type: ESCU
 version: 1
diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
index d4eece9b83..8495c184eb 100644
--- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
+++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
@@ -4,20 +4,20 @@ description: "This search provides detection of high risk permissions by resourc
 how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
 id: 2e70ef35-2187-431f-aedc-4503dc9b06ba
 known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives."
-name: "gcp detect high risk permissions by resource and account"
+name: GCP Detect high risk permissions by resource and account
 references:
   - https://github.com/dxa4481/gcploit
   - https://www.youtube.com/watch?v=Ml09R38jpok
   - https://cloud.google.com/iam/docs/permissions-reference
-search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account`
+search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`"
 tags:
   analytics_story:
-    - "GCP Cross Account Activity"
+  - GCP Cross Account Activity
   asset_type: "GCP Account"
   kill_chain_phases:
-    - Lateral Movement
+  - Lateral Movement
   mitre_attack_id:
-    - T1078
+  - T1078
   security_domain: threat
 type: ESCU
 version: 1
diff --git a/detections/gcp_detect_oauth_token_abuse.yml b/detections/gcp_detect_oauth_token_abuse.yml
index 3b6fa23ebd..fa55c444ec 100644
--- a/detections/gcp_detect_oauth_token_abuse.yml
+++ b/detections/gcp_detect_oauth_token_abuse.yml
@@ -8,15 +8,15 @@ name: "gcp detect oauth token abuse"
 references:
   - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1
   - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-2
-search: '`sourcetype=google:gcp:pubsub:message type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message  | `gcp_detect_oauth_token_abuse`'
+search: '`google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message  | `gcp_detect_oauth_token_abuse_filter`'
 tags:
   analytics_story:
-    - "GCP Cross Account Activity"
+  - GCP Cross Account Activity
   asset_type: "GCP Account"
   kill_chain_phases:
-    - Lateral Movement
+  - Lateral Movement
   mitre_attack_id:
-    - T1078
+  - T1078
   security_domain: threat
 type: ESCU
 version: 1

From c457ba1ce256d9d30772ff7afa627b1d1e7d17b2 Mon Sep 17 00:00:00 2001
From: Stanislav Miskovic <smiskovic@splunk.com>
Date: Sun, 18 Oct 2020 22:23:18 -0700
Subject: [PATCH 08/23] We need to do 2 fixes here:

1) comma sign is also possible between "comsvcs.dll" "MiniDump" in execution of this attack as described in https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ and https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz and our notebook https://confluence.splunk.com/display/~smiskovic/Test+Events+for+SSA+Detections#TestEventsforSSADetections-DumpingLSASSprocessmemory, and

2) referenced pdf does not contain this detection (will fix this later when I make my notebook public, so we do not need to refer any external companies)
---
 .../endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml
index bf7333ff06..2b4b9452f3 100644
--- a/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml
+++ b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml
@@ -16,7 +16,7 @@ process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
 timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
 process=lower(ucast(map_get(input_event, "process"), "string", null))
 | where process_name LIKE "%rundll32.exe%"
-AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true
+AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
 | eval start_time = timestamp,
        end_time = timestamp,
        entities = mvappend(machine),

From 6d76a4d268b5d42f8e24926e68475c7071ef3e6a Mon Sep 17 00:00:00 2001
From: Stanislav Miskovic <smiskovic@splunk.com>
Date: Sun, 18 Oct 2020 22:46:39 -0700
Subject: [PATCH 09/23] Fix: 1) Adding both long and short name registry
 section names for Security, SAM and System 2) Adding a condition that command
 line marameter is not null (faster exit in case customer is not logging
 command lines)

---
 ...ntial_dump_from_registry_via_reg_exe___ssa.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
index 98c7489a31..5debe42be2 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
@@ -17,12 +17,15 @@ search: '
        dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
        dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
 | where process_name="cmd.exe" OR process_name="reg.exe"
-| where cmd_line LIKE "%save%" AND
-        (match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
-        match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true
-        OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
-        OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true
-        OR match_regex(cmd_line, /(?i)HKLM\\Security/)=true)
+| where cmd_line != null  AND 
+        match_regex(cmd_line, /(?i)save\s+/)=true AND
+        ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR
+          match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR
+          match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
+          match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR
+          match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR
+          match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true 
+        )
 | eval start_time = timestamp,
 end_time = timestamp,
 entities = mvappend(dest_device_id, dest_user_id),

From 1daaefe1a3b238c5ab3ae20713896c9dbb82fe5f Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:14:08 +0000
Subject: [PATCH 10/23] Bump cryptography from 2.8 to 3.1.1

Bumps [cryptography](https://github.com/pyca/cryptography) from 2.8 to 3.1.1.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/2.8...3.1.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 96b4b81c70..b6661cc935 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -14,7 +14,7 @@ cfgv==2.0.1
 chardet==3.0.4
 configparser==4.0.2
 contextlib2==0.6.0.post1
-cryptography==2.8
+cryptography==3.1.1
 Deprecated==1.2.10
 dnspython==2.0.0
 docutils==0.16

From 246fefb4b86834fdc4639b3adf46ae18fff33f6f Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:18:54 +0000
Subject: [PATCH 11/23] Bump splunk-sdk from 1.6.12 to 1.6.14

Bumps [splunk-sdk](https://github.com/splunk/splunk-sdk-python) from 1.6.12 to 1.6.14.
- [Release notes](https://github.com/splunk/splunk-sdk-python/releases)
- [Changelog](https://github.com/splunk/splunk-sdk-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/splunk/splunk-sdk-python/compare/1.6.12...1.6.14)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index b6661cc935..ccb617dcb8 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -61,7 +61,7 @@ requests-ntlm==1.1.0
 s3transfer==0.3.3
 six==1.13.0
 smmap==3.0.4
-splunk-sdk==1.6.12
+splunk-sdk==1.6.14
 tabulate==0.8.6
 termcolor==1.1.0
 toml==0.10.0

From 734a24a595e0b7a6289bdb7dc32e333ce2a6623c Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:23:57 +0000
Subject: [PATCH 12/23] Bump pexpect from 4.7.0 to 4.8.0

Bumps [pexpect](https://github.com/pexpect/pexpect) from 4.7.0 to 4.8.0.
- [Release notes](https://github.com/pexpect/pexpect/releases)
- [Commits](https://github.com/pexpect/pexpect/compare/4.7.0...4.8.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index ccb617dcb8..85df135ba8 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -38,7 +38,7 @@ packer.py==0.3.0
 paramiko==2.7.2
 path==15.0.0
 path.py==12.5.0
-pexpect==4.7.0
+pexpect==4.8.0
 pluggy==0.13.1
 pre-commit==1.21.0
 protobuf==3.13.0

From 3a4260142607b245b733f74f6bf8a749f71a8ec4 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:29:22 +0000
Subject: [PATCH 13/23] Bump cffi from 1.13.2 to 1.14.3

Bumps [cffi](https://github.com/python-cffi/release-doc) from 1.13.2 to 1.14.3.
- [Release notes](https://github.com/python-cffi/release-doc/releases)
- [Commits](https://github.com/python-cffi/release-doc/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 85df135ba8..af2d6b0ab6 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -9,7 +9,7 @@ bcrypt==3.2.0
 boto3==1.15.18
 botocore==1.18.18
 certifi==2019.11.28
-cffi==1.13.2
+cffi==1.14.3
 cfgv==2.0.1
 chardet==3.0.4
 configparser==4.0.2

From 815ef336888b05d1be3fa90b627c2605bdbdf0f8 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:35:03 +0000
Subject: [PATCH 14/23] Bump mysql-connector-python from 8.0.21 to 8.0.22

Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html) from 8.0.21 to 8.0.22.

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index af2d6b0ab6..abfe262396 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -30,7 +30,7 @@ lockfile==0.12.2
 MarkupSafe==1.1.1
 mock==4.0.2
 more-itertools==8.0.2
-mysql-connector-python==8.0.21
+mysql-connector-python==8.0.22
 nodeenv==1.3.4
 ntlm-auth==1.5.0
 packaging==19.2

From 1f83645b6b164a2468521ac8ef8a8f41b36be51f Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:40:37 +0000
Subject: [PATCH 15/23] Bump tabulate from 0.8.6 to 0.8.7

Bumps [tabulate](https://github.com/astanin/python-tabulate) from 0.8.6 to 0.8.7.
- [Release notes](https://github.com/astanin/python-tabulate/releases)
- [Changelog](https://github.com/astanin/python-tabulate/blob/master/CHANGELOG)
- [Commits](https://github.com/astanin/python-tabulate/compare/v0.8.6...v0.8.7)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index abfe262396..c7b57b4a5f 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -62,7 +62,7 @@ s3transfer==0.3.3
 six==1.13.0
 smmap==3.0.4
 splunk-sdk==1.6.14
-tabulate==0.8.6
+tabulate==0.8.7
 termcolor==1.1.0
 toml==0.10.0
 urllib3==1.25.7

From f8151f705fa676320c8fe5461f3d21aad59a470d Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:46:21 +0000
Subject: [PATCH 16/23] Bump packaging from 19.2 to 20.4

Bumps [packaging](https://github.com/pypa/packaging) from 19.2 to 20.4.
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pypa/packaging/compare/19.2...20.4)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index c7b57b4a5f..618a9ae39b 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -33,7 +33,7 @@ more-itertools==8.0.2
 mysql-connector-python==8.0.22
 nodeenv==1.3.4
 ntlm-auth==1.5.0
-packaging==19.2
+packaging==20.4
 packer.py==0.3.0
 paramiko==2.7.2
 path==15.0.0

From fa3f0c2b99a5cdd8eee9017ec56aa1d670516380 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:51:52 +0000
Subject: [PATCH 17/23] Bump urllib3 from 1.25.10 to 1.25.11

Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.25.10 to 1.25.11.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/master/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/1.25.10...1.25.11)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 requirements.txt                             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 618a9ae39b..555d7a434b 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -65,7 +65,7 @@ splunk-sdk==1.6.14
 tabulate==0.8.7
 termcolor==1.1.0
 toml==0.10.0
-urllib3==1.25.7
+urllib3==1.25.11
 virtualenv==16.7.9
 wcwidth==0.2.5
 wget==3.2
diff --git a/requirements.txt b/requirements.txt
index 9851e7f402..97f434a9a9 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -37,6 +37,6 @@ stix2-patterns==1.3.1
 taxii2-client==2.2.2
 toml==0.10.1
 typing==3.7.4.3
-urllib3==1.25.10
+urllib3==1.25.11
 virtualenv==20.0.33
 zipp==3.3.1

From f74eac4531e607118ab124fa03d98b467ce3a781 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 14:57:23 +0000
Subject: [PATCH 18/23] Bump jmespath from 0.9.4 to 0.10.0

Bumps [jmespath](https://github.com/jmespath/jmespath.py) from 0.9.4 to 0.10.0.
- [Release notes](https://github.com/jmespath/jmespath.py/releases)
- [Changelog](https://github.com/jmespath/jmespath.py/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/jmespath/jmespath.py/compare/0.9.4...0.10.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 555d7a434b..c1ef217de8 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -25,7 +25,7 @@ identify==1.4.10
 idna==2.8
 importlib-metadata==1.3.0
 Jinja2==2.10.3
-jmespath==0.9.4
+jmespath==0.10.0
 lockfile==0.12.2
 MarkupSafe==1.1.1
 mock==4.0.2

From 7eb89f7e8366bf6ee5e8c4e29bac9f3f0ff42a73 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 15:03:39 +0000
Subject: [PATCH 19/23] Bump ansible from 2.9.2 to 2.10.1

Bumps [ansible](https://github.com/ansible/ansible) from 2.9.2 to 2.10.1.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/compare/v2.9.2...v2.10.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index c1ef217de8..bc3134dcc5 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -1,4 +1,4 @@
-ansible==2.9.2
+ansible==2.10.1
 ansible-runner==1.4.6
 apipkg==1.5
 aspy.yaml==1.3.0

From 988d12370448c954106567cab8d00caae7bb216b Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Mon, 19 Oct 2020 10:10:09 -0700
Subject: [PATCH 20/23] reorg dir

---
 .../gcp_detect_accounts_with_high_risk_roles_by_project.yml       | 0
 detections/{ => cloud}/gcp_detect_gcploit_framework.yml           | 0
 .../gcp_detect_high_risk_permissions_by_resource_and_account.yml  | 0
 3 files changed, 0 insertions(+), 0 deletions(-)
 rename detections/{ => cloud}/gcp_detect_accounts_with_high_risk_roles_by_project.yml (100%)
 rename detections/{ => cloud}/gcp_detect_gcploit_framework.yml (100%)
 rename detections/{ => cloud}/gcp_detect_high_risk_permissions_by_resource_and_account.yml (100%)

diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml
similarity index 100%
rename from detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml
rename to detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml
diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/cloud/gcp_detect_gcploit_framework.yml
similarity index 100%
rename from detections/gcp_detect_gcploit_framework.yml
rename to detections/cloud/gcp_detect_gcploit_framework.yml
diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml
similarity index 100%
rename from detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml
rename to detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml

From 56b06d22469f92178119102234338c33b913aef2 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 18:04:13 +0000
Subject: [PATCH 21/23] Bump virtualenv from 20.0.33 to 20.0.35

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.0.33 to 20.0.35.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](https://github.com/pypa/virtualenv/compare/20.0.33...20.0.35)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 requirements.txt                             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index bc3134dcc5..3d6817a716 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -66,7 +66,7 @@ tabulate==0.8.7
 termcolor==1.1.0
 toml==0.10.0
 urllib3==1.25.11
-virtualenv==16.7.9
+virtualenv==20.0.35
 wcwidth==0.2.5
 wget==3.2
 wrapt==1.12.1
diff --git a/requirements.txt b/requirements.txt
index 97f434a9a9..1e9791ee3b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -38,5 +38,5 @@ taxii2-client==2.2.2
 toml==0.10.1
 typing==3.7.4.3
 urllib3==1.25.11
-virtualenv==20.0.33
+virtualenv==20.0.35
 zipp==3.3.1

From 45f1b31891c65caa9909e25b247a60568356e254 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 19:31:16 +0000
Subject: [PATCH 22/23] Bump botocore from 1.18.18 to 1.19.0

Bumps [botocore](https://github.com/boto/botocore) from 1.18.18 to 1.19.0.
- [Release notes](https://github.com/boto/botocore/releases)
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/botocore/compare/1.18.18...1.19.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 3d6817a716..039b6538b9 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -7,7 +7,7 @@ attackcti==0.3.3
 attrs==19.3.0
 bcrypt==3.2.0
 boto3==1.15.18
-botocore==1.18.18
+botocore==1.19.0
 certifi==2019.11.28
 cffi==1.14.3
 cfgv==2.0.1

From 2fd0c55f4c341ba6e1d66e506c982bb4d1b360ff Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2020 19:37:04 +0000
Subject: [PATCH 23/23] Bump boto3 from 1.15.18 to 1.16.0

Bumps [boto3](https://github.com/boto/boto3) from 1.15.18 to 1.16.0.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/boto3/compare/1.15.18...1.16.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 039b6538b9..c51102865c 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -6,7 +6,7 @@ atomicwrites==1.4.0
 attackcti==0.3.3
 attrs==19.3.0
 bcrypt==3.2.0
-boto3==1.15.18
+boto3==1.16.0
 botocore==1.19.0
 certifi==2019.11.28
 cffi==1.14.3