mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' into AD_Discovery_TR-789
This commit is contained in:
patel-bhavin
@@ -0,0 +1,37 @@
|
||||
# This file uses .gitignore syntax:
|
||||
#
|
||||
# To ignore a file anywhere it occurs in your project, enter a
|
||||
# glob pattern here. E.g. "*.min.js".
|
||||
#
|
||||
# To ignore a directory anywhere it occurs in your project, add
|
||||
# a trailing slash to the file name. E.g. "dist/".
|
||||
#
|
||||
# To ignore a file or directory only relative to the project root,
|
||||
# include a slash anywhere except the last character. E.g.
|
||||
# "/dist/", or "src/generated".
|
||||
#
|
||||
# Some parts of .gitignore syntax are not supported, and patterns
|
||||
# using this syntax will be dropped from the ignore list:
|
||||
# - Explicit "include syntax", e.g. "!kept/".
|
||||
# - Multi-character expansion syntax, e.g. "*.py[cod]"
|
||||
#
|
||||
# To include ignore patterns from another file, start a line
|
||||
# with ':include', followed by the path of the file. E.g.
|
||||
# ":include path/to/other/ignore/file".
|
||||
#
|
||||
# To ignore a file with a literal ':' character, escape it with
|
||||
# a backslash, e.g. "\:foo".
|
||||
|
||||
# Ignore git items
|
||||
.gitignore
|
||||
.git/
|
||||
:include .gitignore
|
||||
|
||||
#spl files may contain eval and other statements that should NOT trigger semgrep warnings
|
||||
*.spl
|
||||
|
||||
#Temporarily ignoring this directory as we discuss a path moving forward
|
||||
#for Splunk Packaging Toolkit Update Strategy
|
||||
/dist/
|
||||
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
name: Github Commit In Develop
|
||||
id: f3030cb6-0b02-11ec-8f22-acde48001122
|
||||
version: 1
|
||||
date: '2021-09-01'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This search is to detect a pushed or commit to develop branch. This is
|
||||
to avoid unwanted modification to develop without a review to the changes. Ideally
|
||||
in terms of devsecops the changes made in a branch and do a PR for review. of course
|
||||
in some cases admin of the project may did a changes directly to master branch
|
||||
search: '`github` branches{}.name = main OR branches{}.name = develop | stats count
|
||||
min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email
|
||||
commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_in_develop_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs related to github logs having the fork, commit, push metadata that can be use
|
||||
to monitor the changes in a github project.
|
||||
known_false_positives: admin can do changes directly to develop branch
|
||||
references:
|
||||
- https://www.redhat.com/en/topics/devops/what-is-devsecops
|
||||
tags:
|
||||
analytic_story:
|
||||
- DevSecOps
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_develop.json
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: suspicious commit by $commit.commit.author.email$ to develop branch
|
||||
mitre_attack_id:
|
||||
- T1199
|
||||
observable:
|
||||
- name: commit.commit.author.email
|
||||
type: User
|
||||
role:
|
||||
- attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
name: GitHub Dependabot Alert
|
||||
id: 05032b04-4469-4034-9df7-05f607d75cba
|
||||
version: 1
|
||||
date: '2021-09-01'
|
||||
author: Patrick Bareiss, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This search looks for Dependabot Alerts in Github logs.
|
||||
search: '`github` alert.id=* action=create | rename repository.full_name as repository,
|
||||
repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
|
||||
as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
|
||||
alert.external_identifier alert.external_reference alert.fixed_in alert.severity
|
||||
repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `github_dependabot_alert_filter`'
|
||||
how_to_implement: You must index GitHub logs. You can follow the url in reference
|
||||
to onboard GitHub logs.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Dev Sec Ops
|
||||
asset_type: GitHub
|
||||
cis20:
|
||||
- CIS 13
|
||||
confidence: 90
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Vulnerabilities found in packages used by GitHub repository $repository$
|
||||
mitre_attack_id:
|
||||
- T1195.001
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.AC
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: repository
|
||||
type: System
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Dev Sec Ops Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- alert.id
|
||||
- repository.full_name
|
||||
- repository.html_url
|
||||
- action
|
||||
- alert.affected_package_name
|
||||
- alert.affected_range
|
||||
- alert.created_at
|
||||
- alert.external_identifier
|
||||
- alert.external_reference
|
||||
- alert.fixed_in
|
||||
- alert.severity
|
||||
risk_score: 27
|
||||
security_domain: network
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json
|
||||
@@ -0,0 +1,64 @@
|
||||
name: GitHub Pull Request from Unknown User
|
||||
id: 9d7b9100-8878-4404-914e-ca5e551a641e
|
||||
version: 1
|
||||
date: '2021-09-01'
|
||||
author: Patrick Bareiss, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This search looks for Pull Request from unknown user.
|
||||
search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
|
||||
check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref
|
||||
check_suite.head_commit.message | rename check_suite.head_commit.author.name as
|
||||
user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref
|
||||
as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users`
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
|
||||
how_to_implement: You must index GitHub logs. You can follow the url in reference
|
||||
to onboard GitHub logs.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Dev Sec Ops
|
||||
asset_type: GitHub
|
||||
cis20:
|
||||
- CIS 13
|
||||
confidence: 90
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Vulnerabilities found in packages used by GitHub repository $repository$
|
||||
mitre_attack_id:
|
||||
- T1195.001
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.AC
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: repository
|
||||
type: System
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Dev Sec Ops Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- alert.id
|
||||
- repository.full_name
|
||||
- repository.html_url
|
||||
- action
|
||||
- alert.affected_package_name
|
||||
- alert.affected_range
|
||||
- alert.created_at
|
||||
- alert.external_identifier
|
||||
- alert.external_reference
|
||||
- alert.fixed_in
|
||||
- alert.severity
|
||||
risk_score: 27
|
||||
security_domain: network
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_pull_request/github_pull_request.json
|
||||
@@ -1,24 +1,31 @@
|
||||
name: Process Creating LNK file in Suspicious Location
|
||||
id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
|
||||
version: 4
|
||||
date: '2021-01-28'
|
||||
version: 5
|
||||
date: '2021-08-26'
|
||||
author: Jose Hernandez, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search looks for a process launching an `*.lnk` file under `C:\User*`
|
||||
or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
|
||||
AND Filesystem.file_path="C:\\Temp*" by _time span=1h Filesystem.process_id Filesystem.file_name
|
||||
Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
|
||||
| rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly`
|
||||
count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time
|
||||
span=1h Processes.parent_process_id Processes.process_id Processes.process_name
|
||||
Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
|
||||
| rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name
|
||||
process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
|
||||
process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` '
|
||||
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*")
|
||||
by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user
|
||||
| `drop_dm_object_name(Filesystem)`
|
||||
| rename process_guid as lnk_guid
|
||||
| join lnk_guid, _time
|
||||
[| tstats `security_content_summariesonly`
|
||||
count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time
|
||||
span=1h Processes.parent_process_guid Processes.process_id Processes.process_name
|
||||
Processes.dest Processes.process_path Processes.process
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| rename parent_process_guid as lnk_guid
|
||||
| fields _time lnk_guid process_id dest process_name
|
||||
process_path process]
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| table firstTime, lastTime, lnk_guid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash
|
||||
| `process_creating_lnk_file_in_suspicious_location_filter`'
|
||||
how_to_implement: You must be ingesting data that records filesystem and process activity
|
||||
from your hosts to populate the Endpoint data model. This is typically populated
|
||||
via endpoint detection-and-response product, such as Carbon Black, or endpoint data
|
||||
@@ -77,3 +84,4 @@ tags:
|
||||
- Filesystem.user
|
||||
risk_score: 63
|
||||
security_domain: network
|
||||
|
||||
|
||||
+23
-12
@@ -7,8 +7,8 @@ This project gives you access to our repository of Analytic Stories that are sec
|
||||
|
||||
## View Our Content
|
||||
|
||||
* [Analytic Stories](docs/stories.md)
|
||||
* [Detections](docs/detections.md)
|
||||
* [Analytic Stories](https://github.com/splunk/security_content/blob/develop/docs/stories.md)
|
||||
* [Detections](https://github.com/splunk/security_content/blob/develop/docs/detections.md)
|
||||
|
||||
If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):
|
||||
|
||||
@@ -26,7 +26,7 @@ The [attack_range](https://github.com/splunk/attack_range) project allows you to
|
||||
If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security_content#support).
|
||||
|
||||
## Contribute Content
|
||||
If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!
|
||||
If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project). Digital defenders unite!
|
||||
|
||||
|
||||
## Content Parts
|
||||
@@ -34,14 +34,25 @@ If you want to help the rest of the security community by sharing your own detec
|
||||
* [detections/](https://github.com/splunk/security_content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
|
||||
* [response_tasks/](https://github.com/splunk/security_content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
|
||||
* [responses/](https://github.com/splunk/security_content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
|
||||
* [baselines/](https://github.com/splunk/security_content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
|
||||
|
||||
|
||||
#### Content Spec Files
|
||||
* [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.spec.md)
|
||||
* [detections](https://github.com/splunk/security_content/blob/develop/docs/spec/detections.spec.md)
|
||||
* [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.spec.md)
|
||||
* [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.spec.md)
|
||||
* [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.spec.md)
|
||||
* [baselines](https://github.com/splunk/security_content/blob/develop/docs/spec/baselines.spec.md)
|
||||
* [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.spec.md)
|
||||
* [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.spec.md)
|
||||
* [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.md)
|
||||
* [detections](https://github.com/splunk/security_content/blob/develop/docs/spec/detections.md)
|
||||
* [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.md)
|
||||
* [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.md)
|
||||
* [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.md)
|
||||
* [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.md)
|
||||
* [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.md)
|
||||
|
||||
# MITRE ATT&CK ⚔️
|
||||
### Detection Coverage
|
||||
To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
|
||||
|
||||
|
||||
|
||||
### Detection Priority by Threat Actors
|
||||
If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer in [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/). Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
definition: user IN (user_names_here)
|
||||
description: specify the user allowed to create PRs in Github projects.
|
||||
name: github_known_users
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Github Commit In Develop Unit Test
|
||||
tests:
|
||||
- name: Github Commit In Develop
|
||||
file: cloud/github_commit_in_develop.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: github_push_develop.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_develop.json
|
||||
source: github
|
||||
sourcetype: aws:firehose:json
|
||||
@@ -0,0 +1,12 @@
|
||||
name: GitHub Dependabot Alert Unit Test
|
||||
tests:
|
||||
- name: GitHub Dependabot Alert
|
||||
file: cloud/github_dependabot_alert.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-365d'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: github_security_advisor_alert.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json
|
||||
sourcetype: aws:firehose:json
|
||||
source: github
|
||||
@@ -0,0 +1,12 @@
|
||||
name: GitHub Pull Request from Unknown User Unit Test
|
||||
tests:
|
||||
- name: GitHub Pull Request from Unknown User
|
||||
file: cloud/github_pull_request_from_unknown_user.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-365d'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: github_pull_request.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_pull_request/github_pull_request.json
|
||||
sourcetype: aws:firehose:json
|
||||
source: github
|
||||
Reference in New Issue
Block a user