From a9dc524ad9f1fa6886348e14ec54ef4993bd1391 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 27 Jun 2023 12:07:55 -0700 Subject: [PATCH 1/3] Make changes to lookup validation to ensure that the structure of .csv files, along with their quoting and number of fields, is correct. --- .../contentctl_core/domain/entities/lookup.py | 25 +++++++++ lookups/privileged_azure_ad_roles.csv | 51 +++++++++---------- lookups/splunk_risky_command.csv | 22 ++++---- 3 files changed, 61 insertions(+), 37 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/lookup.py b/bin/contentctl_project/contentctl_core/domain/entities/lookup.py index 1aa8e6844a..75ed1e3ff3 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/lookup.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/lookup.py @@ -49,5 +49,30 @@ class Lookup(BaseModel, SecurityContentObject): raise ValueError( f"Lookup references lookup file '{lookup_file_path}', but that file does not exist." ) + + #Also check the format of the lookup file. It MUST be a valid CSV. Valid CSV must have the + #correct number of fields (each row has the same number of columns, even if empty, as the + # number of columns declared at the top of the file) + import csv + with open(lookup_file_path, "r") as csv_file_obj: + reader = csv.reader(csv_file_obj, delimiter=',',quoting=csv.QUOTE_ALL) + try: + reader_list = list(reader) + except Exception as e: + raise ValueError(f"Error validating lookup file '{lookup_file_path}': the follow error was encountered when parsing the csv file: {str(e)}") + if len(reader_list)>0: + csv_keys = reader_list[0] + else: + raise ValueError(f"Error validating lookup file '{lookup_file_path}': 0 rows found in file. a csv MUST contain at least one row (which contains the field names)") + row_errors=[] + for index,row in enumerate(reader_list[1:]): + if len(row) != len(csv_keys) and len(row) != 0: + row_errors.append(f"Error in row {index+2}: expected {len(csv_keys)} columns but got {len(row)}.") + if len(row_errors) > 0: + condensed_string = '\n\t'.join(row_errors) + raise ValueError(f"Error validating lookup file '{lookup_file_path}':\n\t{condensed_string}.") + return v + + diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv index 4a3e41649c..02a71039c8 100644 --- a/lookups/privileged_azure_ad_roles.csv +++ b/lookups/privileged_azure_ad_roles.csv @@ -1,27 +1,26 @@ -azureadrole,isprvilegedadrole,description -"""Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user. -"""Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials. -"""Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices. -"""Azure DevOps Administrator""",True,Can manage Azure DevOps policies and settings. -"""Azure Information Protection Administrator""",True,Can manage all aspects of the Azure Information Protection product. -"""Cloud Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps except App Proxy. -"""Cloud Device Administrator""",True,Limited access to manage devices in Azure AD. -"""Compliance Administrator""",True,Can read and manage compliance configuration and reports in Azure AD and Microsoft 365. -"""Conditional Access Administrator""",True,Can manage Conditional Access capabilities. -"""Exchange Administrator""",True,Can manage all aspects of the Exchange product. -"""External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation. -"""Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports. -"""Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators. -"""Hybrid Identity Administrator""",True,Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings. -"""Intune Administrator""",True,Can manage all aspects of the Intune product. -"""License Administrator""",True,Can manage product licenses on users and groups. -"""Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications. -"""Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators. -"""Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management. -"""Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365. -"""SharePoint Administrator""",True,Can manage all aspects of the SharePoint service. -"""Teams Administrator""",True,Can manage the Microsoft Teams service. -"""User Administrator""",True,Can manage all aspects of users and groups, including resetting passwords for limited admins. -"""Windows 365 Administrator""",True,Can provision and manage all aspects of Cloud PCs. - +"azureadrole","isprvilegedadrole","description" +"Authentication Administrator","True","Can access to view, set and reset authentication method information for any non-admin user." +"Authentication Policy Administrator","True","Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials." +"Azure AD Joined Device Local Administrator","True","Users assigned to this role are added to the local administrators group on Azure AD-joined devices." +"Azure DevOps Administrator","True","Can manage Azure DevOps policies and settings." +"Azure Information Protection Administrator","True","Can manage all aspects of the Azure Information Protection product." +"Cloud Application Administrator","True","Can create and manage all aspects of app registrations and enterprise apps except App Proxy." +"Cloud Device Administrator","True","Limited access to manage devices in Azure AD." +"Compliance Administrator","True","Can read and manage compliance configuration and reports in Azure AD and Microsoft 365." +"Conditional Access Administrator","True","Can manage Conditional Access capabilities." +"Exchange Administrator","True","Can manage all aspects of the Exchange product." +"External Identity Provider Administrator","True","Can configure identity providers for use in direct federation." +"Groups Administrator","True","Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports." +"Helpdesk Administrator","True","Can reset passwords for non-administrators and Helpdesk Administrators." +"Hybrid Identity Administrator","True","Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings." +"Intune Administrator","True","Can manage all aspects of the Intune product." +"License Administrator","True","Can manage product licenses on users and groups." +"Network Administrator","True","Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications." +"Password Administrator","True","Can reset passwords for non-administrators and Password Administrators." +"Privileged Role Administrator","True","Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management." +"Security Administrator","True","Can read security information and reports, and manage configuration in Azure AD and Office 365." +"SharePoint Administrator","True","Can manage all aspects of the SharePoint service." +"Teams Administrator","True","Can manage the Microsoft Teams service." +"User Administrator","True","Can manage all aspects of users and groups, including resetting passwords for limited admins." +"Windows 365 Administrator","True","Can provision and manage all aspects of Cloud PCs." diff --git a/lookups/splunk_risky_command.csv b/lookups/splunk_risky_command.csv index b7d885aa5b..9f6e6665b0 100644 --- a/lookups/splunk_risky_command.csv +++ b/lookups/splunk_risky_command.csv @@ -1,11 +1,11 @@ -splunk_risky_command,description,vulnerable_versions,CVE,other_metadata -*createrss*,createrss command overwrites existing RSS feeds without verifying permissions, 8.1.13 8.2.10,CVE-2023-22931 -*pivot?seedSid=*,pivot command allows a search to bypass SPL safeguards for risky commands using a saved job,8.1.13,8.2.10,9.0.4,CVE-2023-22934 -*|makeresults+&search_listener*,search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user,8.1.13 8.2.10 9.0.4,CVE-2023-22936 -*| map search=*| *,map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands,8.1.13 8.2.10 9.0.4,CVE-2023-22939 -*|mcollect%20index*" ,collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940 -*|"*meventcollect*" ,collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940 -*|"*summaryindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940 -*|"*sumindex*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940 -*|"*stash*",collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access,8.1.13,8.2.10,9.0.4,CVE-2023-22940 -*| sendalert *,display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation,8.1.13 8.2.10 9.0.4,CVE-2023-22935 +"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata" +"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931","" +"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934","" +"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936","" +"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939","" +"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" +"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" +"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" +"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" +"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" +"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935","" \ No newline at end of file From 22eb90a78f6083557c146cedc5fbd68a49b9f0fc Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 27 Jun 2023 12:43:09 -0700 Subject: [PATCH 2/3] Bump detection versions because their underlying lookups have been updated to deal with previous formatting issues. --- .../splunk_risky_command_abuse_disclosed_february_2023.yml | 2 +- .../azure_ad_privileged_role_assigned_to_service_principal.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml index c26f13d43a..94804f1a3a 100644 --- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml +++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -1,6 +1,6 @@ name: Splunk risky Command Abuse disclosed february 2023 id: ee69374a-d27e-4136-adac-956a96ff60fd -version: 1 +version: 2 date: '2023-02-14' author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk status: production diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 81216e2344..4714c4b7b6 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -1,6 +1,6 @@ name: Azure AD Privileged Role Assigned to Service Principal id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41 -version: 1 +version: 2 date: '2023-04-28' author: Mauricio Velazco, Splunk status: production From 59466204491c1808027d0019a7c6895bb84e741d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 27 Jun 2023 13:02:02 -0700 Subject: [PATCH 3/3] Fixing quotation marks that SHOULD have been included in a field but were removed. --- lookups/privileged_azure_ad_roles.csv | 48 +++++++++++++-------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv index 02a71039c8..d4260b6ba3 100644 --- a/lookups/privileged_azure_ad_roles.csv +++ b/lookups/privileged_azure_ad_roles.csv @@ -1,26 +1,26 @@ "azureadrole","isprvilegedadrole","description" -"Authentication Administrator","True","Can access to view, set and reset authentication method information for any non-admin user." -"Authentication Policy Administrator","True","Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials." -"Azure AD Joined Device Local Administrator","True","Users assigned to this role are added to the local administrators group on Azure AD-joined devices." -"Azure DevOps Administrator","True","Can manage Azure DevOps policies and settings." -"Azure Information Protection Administrator","True","Can manage all aspects of the Azure Information Protection product." -"Cloud Application Administrator","True","Can create and manage all aspects of app registrations and enterprise apps except App Proxy." -"Cloud Device Administrator","True","Limited access to manage devices in Azure AD." -"Compliance Administrator","True","Can read and manage compliance configuration and reports in Azure AD and Microsoft 365." -"Conditional Access Administrator","True","Can manage Conditional Access capabilities." -"Exchange Administrator","True","Can manage all aspects of the Exchange product." -"External Identity Provider Administrator","True","Can configure identity providers for use in direct federation." -"Groups Administrator","True","Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports." -"Helpdesk Administrator","True","Can reset passwords for non-administrators and Helpdesk Administrators." -"Hybrid Identity Administrator","True","Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings." -"Intune Administrator","True","Can manage all aspects of the Intune product." -"License Administrator","True","Can manage product licenses on users and groups." -"Network Administrator","True","Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications." -"Password Administrator","True","Can reset passwords for non-administrators and Password Administrators." -"Privileged Role Administrator","True","Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management." -"Security Administrator","True","Can read security information and reports, and manage configuration in Azure AD and Office 365." -"SharePoint Administrator","True","Can manage all aspects of the SharePoint service." -"Teams Administrator","True","Can manage the Microsoft Teams service." -"User Administrator","True","Can manage all aspects of users and groups, including resetting passwords for limited admins." -"Windows 365 Administrator","True","Can provision and manage all aspects of Cloud PCs." +"""Authentication Administrator""","True","Can access to view, set and reset authentication method information for any non-admin user." +"""Authentication Policy Administrator""","True","Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials." +"""Azure AD Joined Device Local Administrator""","True","Users assigned to this role are added to the local administrators group on Azure AD-joined devices." +"""Azure DevOps Administrator""","True","Can manage Azure DevOps policies and settings." +"""Azure Information Protection Administrator""","True","Can manage all aspects of the Azure Information Protection product." +"""Cloud Application Administrator""","True","Can create and manage all aspects of app registrations and enterprise apps except App Proxy." +"""Cloud Device Administrator""","True","Limited access to manage devices in Azure AD." +"""Compliance Administrator""","True","Can read and manage compliance configuration and reports in Azure AD and Microsoft 365." +"""Conditional Access Administrator""","True","Can manage Conditional Access capabilities." +"""Exchange Administrator""","True","Can manage all aspects of the Exchange product." +"""External Identity Provider Administrator""","True","Can configure identity providers for use in direct federation." +"""Groups Administrator""","True","Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports." +"""Helpdesk Administrator""","True","Can reset passwords for non-administrators and Helpdesk Administrators." +"""Hybrid Identity Administrator""","True","Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings." +"""Intune Administrator""","True","Can manage all aspects of the Intune product." +"""License Administrator""","True","Can manage product licenses on users and groups." +"""Network Administrator""","True","Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications." +"""Password Administrator""","True","Can reset passwords for non-administrators and Password Administrators." +"""Privileged Role Administrator""","True","Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management." +"""Security Administrator""","True","Can read security information and reports, and manage configuration in Azure AD and Office 365." +"""SharePoint Administrator""","True","Can manage all aspects of the SharePoint service." +"""Teams Administrator""","True","Can manage the Microsoft Teams service." +"""User Administrator""","True","Can manage all aspects of users and groups, including resetting passwords for limited admins." +"""Windows 365 Administrator""","True","Can provision and manage all aspects of Cloud PCs."