From 63ca1449715936cae2b087588ebf4e57a82e7b90 Mon Sep 17 00:00:00 2001 From: research bot Date: Wed, 2 Feb 2022 18:11:51 +0000 Subject: [PATCH 1/2] updating docs and package bits [ci skip] --- .../ssa___hiding_files_and_directories_with_attrib_exe.yml | 5 ++--- dist/escu/app.manifest | 2 +- dist/escu/default/analyticstories.conf | 2 +- dist/escu/default/app.conf | 4 ++-- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 4 ++-- dist/escu/default/transforms.conf | 2 +- ...021-12-20-hiding_files_and_directories_with_attrib_exe.md | 2 +- docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md | 2 +- 11 files changed, 14 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index 9444d3e8d4..7ab062c00c 100644 --- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -16,8 +16,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" | - eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) @@ -76,4 +76,3 @@ tags: - _time risk_score: 72 security_domain: endpoint - diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 8aedf9fc7f..18e0a3ab0c 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.34.1" + "version": "3.34.2" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index c469a5878e..ed4c8cdbf8 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-01-31T19:58:16 UTC +# On Date: 2022-02-02T18:04:53 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 5dc0ab8511..b257498dce 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 4768 +build = 4848 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.34.1 +version = 3.34.2 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index bcef063a65..e0038d4056 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-01-31T19:58:16 UTC +# On Date: 2022-02-02T18:04:53 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 856553a3fb..51f88079bc 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.34.1 +version = 3.34.2 diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index a3be0c7df6..7a4bc6a975 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-01-31T19:58:16 UTC +# On Date: 2022-02-02T18:04:53 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index f4fd97b75b..6769f2872d 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-01-31T19:58:15 UTC +# On Date: 2022-02-02T18:04:53 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -19055,7 +19055,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *", "* 777 *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter` [ESCU - Linux Setuid Using Setcap Utility - Rule] action.escu = 0 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index a3d7ed71f5..776e07cdfa 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-01-31T19:58:16 UTC +# On Date: 2022-02-02T18:04:53 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md index 487c5ce400..26b47191df 100644 --- a/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md @@ -45,7 +45,7 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) -| where cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" +| where cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events(); ``` diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index 2be13491b8..d1cc1c1839 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -47,7 +47,7 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *", "* 777 *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 8d3b68a1c6cacad7b7a764c639c0aacd9f4b6426 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 2 Feb 2022 13:21:53 -0500 Subject: [PATCH 2/2] Create SECURITY.md --- SECURITY.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..5550ccaa58 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ + + + +- [Security Policy](#security-policy) + - [Supported Versions](#supported-versions) + - [Reporting a Vulnerability](#reporting-a-vulnerability) + + + +# Security Policy + +## Supported Versions + +We release patches for security vulnerabilities. Which versions are eligible +receiving such patches depend on the CVSS v3.0 Rating: + + + +| Version | Supported | +| ------- | ------------------ | +| [latest](https://github.com/splunk/security_content/releases/latest) | :white_check_mark: | + + +## Reporting a Vulnerability + +Please report (suspected) security vulnerabilities to +**[research@splunk.com](mailto:research@splunk.com)**. You will receive a response from +us within 48 hours. If the issue is confirmed, we will release a patch as soon +as possible depending on complexity but historically within a few days.