admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-07-13 07:47:43 -07:00
committed by GitHub
parent a55f9bf9f1 deac608058
commit d8d92f59b4
5 changed files with 63 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/domain/entities/lookup.py
+25
View File
@@ -49,5 +49,30 @@ class Lookup(BaseModel, SecurityContentObject):
raise ValueError(
f"Lookup references lookup file '{lookup_file_path}', but that file does not exist."
)
#Also check the format of the lookup file. It MUST be a valid CSV. Valid CSV must have the
#correct number of fields (each row has the same number of columns, even if empty, as the
# number of columns declared at the top of the file)
import csv
with open(lookup_file_path, "r") as csv_file_obj:
reader = csv.reader(csv_file_obj, delimiter=',',quoting=csv.QUOTE_ALL)
try:
reader_list = list(reader)
except Exception as e:
raise ValueError(f"Error validating lookup file '{lookup_file_path}': the follow error was encountered when parsing the csv file: {str(e)}")
if len(reader_list)>0:
csv_keys = reader_list[0]
else:
raise ValueError(f"Error validating lookup file '{lookup_file_path}': 0 rows found in file. a csv MUST contain at least one row (which contains the field names)")
row_errors=[]
for index,row in enumerate(reader_list[1:]):
if len(row) != len(csv_keys) and len(row) != 0:
row_errors.append(f"Error in row {index+2}: expected {len(csv_keys)} columns but got {len(row)}.")
if len(row_errors) > 0:
condensed_string = '\n\t'.join(row_errors)
raise ValueError(f"Error validating lookup file '{lookup_file_path}':\n\t{condensed_string}.")
return v
detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Splunk risky Command Abuse disclosed february 2023
id: ee69374a-d27e-4136-adac-956a96ff60fd
version: 1
version: 2
date: '2023-02-14'
author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
status: production
detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Azure AD Privileged Role Assigned to Service Principal
id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41
version: 1
version: 2
date: '2023-04-28'
author: Mauricio Velazco, Splunk
status: production
lookups/privileged_azure_ad_roles.csv
+25 -26
View File
@@ -1,27 +1,26 @@
azureadrole,isprvilegedadrole,description
"""Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user.
"""Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
"""Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
"""Azure DevOps Administrator""",True,Can manage Azure DevOps policies and settings.
"""Azure Information Protection Administrator""",True,Can manage all aspects of the Azure Information Protection product.
"""Cloud Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
"""Cloud Device Administrator""",True,Limited access to manage devices in Azure AD.
"""Compliance Administrator""",True,Can read and manage compliance configuration and reports in Azure AD and Microsoft 365.
"""Conditional Access Administrator""",True,Can manage Conditional Access capabilities.
"""Exchange Administrator""",True,Can manage all aspects of the Exchange product.
"""External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation.
"""Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
"""Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators.
"""Hybrid Identity Administrator""",True,Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings.
"""Intune Administrator""",True,Can manage all aspects of the Intune product.
"""License Administrator""",True,Can manage product licenses on users and groups.
"""Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
"""Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators.
"""Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
"""Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365.
"""SharePoint Administrator""",True,Can manage all aspects of the SharePoint service.
"""Teams Administrator""",True,Can manage the Microsoft Teams service.
"""User Administrator""",True,Can manage all aspects of users and groups, including resetting passwords for limited admins.
"""Windows 365 Administrator""",True,Can provision and manage all aspects of Cloud PCs.
"azureadrole","isprvilegedadrole","description"
"""Authentication Administrator""","True","Can access to view, set and reset authentication method information for any non-admin user."
"""Authentication Policy Administrator""","True","Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials."
"""Azure AD Joined Device Local Administrator""","True","Users assigned to this role are added to the local administrators group on Azure AD-joined devices."
"""Azure DevOps Administrator""","True","Can manage Azure DevOps policies and settings."
"""Azure Information Protection Administrator""","True","Can manage all aspects of the Azure Information Protection product."
"""Cloud Application Administrator""","True","Can create and manage all aspects of app registrations and enterprise apps except App Proxy."
"""Cloud Device Administrator""","True","Limited access to manage devices in Azure AD."
"""Compliance Administrator""","True","Can read and manage compliance configuration and reports in Azure AD and Microsoft 365."
"""Conditional Access Administrator""","True","Can manage Conditional Access capabilities."
"""Exchange Administrator""","True","Can manage all aspects of the Exchange product."
"""External Identity Provider Administrator""","True","Can configure identity providers for use in direct federation."
"""Groups Administrator""","True","Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports."
"""Helpdesk Administrator""","True","Can reset passwords for non-administrators and Helpdesk Administrators."
"""Hybrid Identity Administrator""","True","Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings."
"""Intune Administrator""","True","Can manage all aspects of the Intune product."
"""License Administrator""","True","Can manage product licenses on users and groups."
"""Network Administrator""","True","Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications."
"""Password Administrator""","True","Can reset passwords for non-administrators and Password Administrators."
"""Privileged Role Administrator""","True","Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management."
"""Security Administrator""","True","Can read security information and reports, and manage configuration in Azure AD and Office 365."
"""SharePoint Administrator""","True","Can manage all aspects of the SharePoint service."
"""Teams Administrator""","True","Can manage the Microsoft Teams service."
"""User Administrator""","True","Can manage all aspects of users and groups, including resetting passwords for limited admins."
"""Windows 365 Administrator""","True","Can provision and manage all aspects of Cloud PCs."
1 azureadrole isprvilegedadrole description
2 "Authentication Administrator" True Can access to view Can access to view, set and reset authentication method information for any non-admin user.
3 "Authentication Policy Administrator" True Can create and manage the authentication methods policy Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
4 "Azure AD Joined Device Local Administrator" True Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
5 "Azure DevOps Administrator" True Can manage Azure DevOps policies and settings.
6 "Azure Information Protection Administrator" True Can manage all aspects of the Azure Information Protection product.
7 "Cloud Application Administrator" True Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
8 "Cloud Device Administrator" True Limited access to manage devices in Azure AD.
9 "Compliance Administrator" True Can read and manage compliance configuration and reports in Azure AD and Microsoft 365.
10 "Conditional Access Administrator" True Can manage Conditional Access capabilities.
11 "Exchange Administrator" True Can manage all aspects of the Exchange product.
12 "External Identity Provider Administrator" True Can configure identity providers for use in direct federation.
13 "Groups Administrator" True Members of this role can create/manage groups Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
14 "Helpdesk Administrator" True Can reset passwords for non-administrators and Helpdesk Administrators.
15 "Hybrid Identity Administrator" True Can manage AD to Azure AD cloud provisioning Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings.
16 "Intune Administrator" True Can manage all aspects of the Intune product.
17 "License Administrator" True Can manage product licenses on users and groups.
18 "Network Administrator" True Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
19 "Password Administrator" True Can reset passwords for non-administrators and Password Administrators.
20 "Privileged Role Administrator" True Can manage role assignments in Azure AD Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
21 "Security Administrator" True Can read security information and reports Can read security information and reports, and manage configuration in Azure AD and Office 365.
22 "SharePoint Administrator" True Can manage all aspects of the SharePoint service.
23 "Teams Administrator" True Can manage the Microsoft Teams service.
24 "User Administrator" True Can manage all aspects of users and groups Can manage all aspects of users and groups, including resetting passwords for limited admins.
25 "Windows 365 Administrator" True Can provision and manage all aspects of Cloud PCs.
26
lookups/splunk_risky_command.csv
+11 -11
View File
@@ -1,11 +1,11 @@
splunk_risky_command,description,vulnerable_versions,CVE,other_metadata
*createrss*,createrss command overwrites existing RSS feeds without verifying permissions, 8.1.13 8.2.10,CVE-2023-22931
*pivot?seedSid=*,pivot command allows a search to bypass SPL safeguards for risky commands using a saved job,8.1.13,8.2.10,9.0.4,CVE-2023-22934
*|makeresults+&search_listener*,search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user,8.1.13 8.2.10 9.0.4,CVE-2023-22936
*| map search=*| *,map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands,8.1.13 8.2.10 9.0.4,CVE-2023-22939
*|mcollect%20index*" ,collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
*|"*meventcollect*" ,collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
*|"*summaryindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
*|"*sumindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
*|"*stash*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940
*| sendalert *,display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation,8.1.13 8.2.10 9.0.4,CVE-2023-22935
"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata"
"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931",""
"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934",""
"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936",""
"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939",""
"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940",""
"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935",""
Can't render this file because it contains an unexpected character in line 6 and column 20.