From b9b90fead510602c55a352b98095d9c99ffeee40 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 6 May 2021 15:41:00 +0000 Subject: [PATCH 1/2] Bump identify from 2.1.3 to 2.2.4 Bumps [identify](https://github.com/pre-commit/identify) from 2.1.3 to 2.2.4. - [Release notes](https://github.com/pre-commit/identify/releases) - [Commits](https://github.com/pre-commit/identify/compare/v2.1.3...v2.2.4) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 4 ++-- requirements.txt | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index c80d492ec3..2655bc4631 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -27,7 +27,7 @@ docutils==0.16 execnet==1.8.0 gitdb==4.0.5 GitPython==3.1.14 -identify==2.1.3 +identify==2.2.4 idna==2.8 importlib-metadata==3.7.3 Jinja2==2.11.3 @@ -50,7 +50,7 @@ psutil==5.8.0 ptyprocess==0.7.0 py==1.10.0 pycparser==2.20 -PyGithub==1.54.1 +PyGithub==1.55 PyInquirer==1.0.3 PyJWT==2.0.1 PyNaCl==1.4.0 diff --git a/requirements.txt b/requirements.txt index 6ee274a04e..9532034f88 100644 --- a/requirements.txt +++ b/requirements.txt @@ -18,7 +18,7 @@ fire==0.3.1 gitdb==4.0.5 html5lib==1.0.1 humanfriendly==9.1 -identify==2.1.3 +identify==2.2.4 idna==2.10 importlib-metadata==3.7.3 importlib-resources==5.1.2 From 375a824d40baaa2ff960a2114556f6511d7075aa Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 6 May 2021 12:58:40 -0400 Subject: [PATCH 2/2] minor update to include DM closes issue #1357 --- detections/endpoint/registry_keys_used_for_persistence.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 9bef6ba923..b585325c63 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -4,7 +4,8 @@ version: 5 date: '2020-11-27' author: David Dorsey, Splunk type: batch -datamodel: [] +datamodel: + - Endpoint description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)