diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml new file mode 100644 index 0000000000..8fbbf86819 --- /dev/null +++ b/.github/workflows/build-and-validate.yml @@ -0,0 +1,275 @@ +#This file makes use of a number of useful, external Github Actions. +#Check the links below for additional documentation on each of these: +#https://github.com/actions/setup-python +#https://github.com/actions/setup-node +#https://github.com/actions/checkout +#https://github.com/actions/upload-artifact + +#The mechanism for persisting data between jobs in a workflow is the same as for persisting it +#permanently: +#https://docs.github.com/en/actions/guides/storing-workflow-data-as-artifacts +#In CircleCI, this was different (store_artifacts vs persist_to_workspace) + + + +name: build-and-validate +on: [push, pull_request] +jobs: + validate-tag-if-present: + runs-on: ubuntu-latest + + steps: + - name: TAGGED, Validate that the tag is in the correct format + + run: | + echo "The GITHUB_REF: $GITHUB_REF" + #First check to see if the release is a tag + if [[ $GITHUB_REF =~ refs/tags/* ]]; then + #Yes, this is a tag, so we need to test to make sure that the tag + #is in the correct format (like v1.10.20) + if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then + echo "PASS: Tagged release with good format" + exit 0 + else + echo "FAIL: Tagged release with bad format" + exit 1 + fi + else + echo "PASS: Not a tagged release" + exit 0 + fi + + validate-content: + #Note that the CircleCI job used a Container. The way to do this with Github Actions + #is to first start up a Virtual Machine, then we can by following: + # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer + runs-on: ubuntu-latest + needs: [validate-tag-if-present] + steps: + #Previous config chose which branch/tag to operate on. + #I think Github is smart enough to choose based on whether it's a pull request or push + other info? + - name: Check out the repository code + uses: actions/checkout@v2 + #with: + # repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD + # path: "security-content" + + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + + #TODO: CircleCI restore_cache equivalent + + #don't need to install python3 or python3-dev since it was handled by the action above? + #Also, no support for YAML anchors/aliases in Github Actions... + - name: Install System Packages + run: | + sudo apt update -qq + sudo apt install jq -qq + #TODO: CircleCI save_cache equivalent + + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + + - name: run validate + run: | + source venv/bin/activate + python3 contentctl.py --path . --verbose validate + + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 + with: + repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD + path: "cti/" + + + #Now generate the documentation (uses Node) + - uses: actions/setup-node@v2 + with: + node-version: '14' #can easily be changed to a different version + - name: Generate documentation + run: | + ls -lah + + #Enter the virtualenv and run the docgen + source venv/bin/activate + python3 bin/doc_gen.py --path . --output docs -v + + #Now generate the spec docs + npm install -g @adobe/jsonschema2md + jsonschema2md -d spec -o docs/spec -f yaml -e spec.json -x - + + #Clean up extra properties on docs + rm -rf docs/spec/*-*.md + + echo "****** BRANCH INFORMATION ******" + git branch + git branch --show-current + + build-sources: + runs-on: ubuntu-latest + needs: validate-content + steps: + - name: Checkout Repo + uses: actions/checkout@v2 + + - name: Install System Packages + run: | + sudo apt update -qq + sudo apt install jq -qq + + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: Run Generate + run: | + source venv/bin/activate + python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu + python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws + #make a copy of use_case_lib in order to have ES work :-( + cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf + cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf + + - name: Copy lookups .csv files + run: | + # clean up current lookups + rm -rf dist/escu/lookups + rm -rf dist/saaws/lookups + mkdir dist/escu/lookups + mkdir dist/saaws/lookups + #copy over lookups + cd lookups + cp -rv *.csv ../dist/escu/lookups + cp -rv *.csv ../dist/saaws/lookups + + #Tag is '' for non-tagged push and the tag name for a tagged release + - name: Set tag + id: vars + run: | + if [ echo ${GITHUB_REF} | grep "^refs/tags/*" ]; then + #failed to find the refs/tags/ beginning, grab and set the tag + echo "::set-output name=tag::${GITHUB_REF#refs/tags/}" + else + #Not a tagged relese + echo "::set-output name=tag::" + fi + + - name: Update Version and Build number + run : | + # check if tag is set, get build number from the tag if set + if [ -z "${{ steps.vars.outputs.tag }}" ]; then + CONTENT_VERSION=$(grep -oP "(\d+.\d+.\d+$)" dist/escu/default/content-version.conf) + echo "detected content version: $CONTENT_VERSION" + else + CONTENT_VERSION=$(echo ${{ steps.vars.outputs.tag }} | grep -oP "\d+.\d+.\d+") + echo "content version: $CONTENT_VERSION, set by tag: ${{ steps.vars.outputs.tag }}" + fi + # update build number and version for ESCU + sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/escu/default/app.conf + sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/app.conf + sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest + sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf + tar -czf content-pack-build-escu.tar.gz dist/escu/* + # update build number and version for saaws + sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf + sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf + sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/saaws/app.manifest + sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/content-version.conf + tar -czf content-pack-build-saaws.tar.gz dist/saaws/* + + - name: Persist to Workspace + uses: actions/upload-artifact@v2 + with: + name: content-pack-build + path: | + content-pack-build-escu.tar.gz + content-pack-build-saaws.tar.gz + + + build-package: + runs-on: ubuntu-latest + needs: [validate-content, build-sources] + + steps: + - uses: actions/download-artifact@v2 + with: + name: content-pack-build + path: build/ + + #This explicitly uses a different version of python (2.7) + - uses: actions/setup-python@v2 + with: + python-version: '2.7' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Get virtualenv for Python 2.7 + run: | + sudo apt install virtualenv + + - name: Grab Splunk Packaging Toolkit + run : | + curl -Ls https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz -o splunk-packaging-toolkit-latest.tar.gz + mkdir slim-latest + tar -zxf splunk-packaging-toolkit-latest.tar.gz -C slim-latest --strip-components=1 + + - name: Install Splunk Packaging Toolkit (slim) + run: | + cd slim-latest + virtualenv --python=/usr/bin/python2.7 --clear venv + source venv/bin/activate + python -m pip install semantic_version + python -m pip install . + - name: Create a .spl for this Build Using Slim + run: | + source slim-latest/venv/bin/activate + cd build + tar -zxf content-pack-build-escu.tar.gz + tar -zxf content-pack-build-saaws.tar.gz + mv dist/escu DA-ESS-ContentUpdate + mv dist/saaws DA-ESS_AmazonWebServices_Content + slim package -o upload DA-ESS-ContentUpdate + slim package -o upload DA-ESS_AmazonWebServices_Content + + cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz + sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt + + cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz + sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz >> checksum.txt + + touch tag-canary.txt + - name: store_artifacts + uses: actions/upload-artifact@v2 + with: + name: package + path: | + build/upload + - name: store_artifacts_two + uses: actions/upload-artifact@v2 + with: + name: content-latest + path: | + build/DA-ESS-ContentUpdate-latest.tar.gz + build/DA-ESS_AmazonWebServices_Content-latest.tar.gz + build/checksum.txt + + #Store the tag to indicate that this was a tagged build + - name: store_artifacts_three + uses: actions/upload-artifact@v2 + with: + name: tag-canary + path: | + build/tag-canary.txt \ No newline at end of file diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 73136663ab..c7dd81d847 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -31,7 +31,7 @@ jobs: environment: Detection-Testing-Approval needs: [validate-tag-if-present] #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') + if: startsWith(github.ref, 'refs/heads/') steps: - name: Checkout Repo diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml new file mode 100644 index 0000000000..ac27b9fe4e --- /dev/null +++ b/.github/workflows/release-checks.yml @@ -0,0 +1,398 @@ +name: release-checks +on: + workflow_run: + workflows: ["validate-and-build"] + types: + - completed + + + +jobs: + + #Check that the validate-and-build workflow succeeded + check-validate-and-build-success: + runs-on: ubuntu-latest + steps: + - if: github.event.workflow_run.conclusion != 'success' + name: Abort if failed + run: | + echo "FAIL: validate-and-build.yml DID NOT run successfully. Terminating..." + exit 1 + - name: Print Success + run: | + echo "SUCCESS: validate-and-build.yml ran successfully. Continue" + exit 0 + + + #Enusre that we are running on a tag. There is no good way to see if this was + #triggered from a tag/release, so we use the creation of an aritifact in the + #validate-and-build workflow to represent it + verify-tag: + runs-on: ubuntu-latest + needs: [check-validate-and-build-success] + steps: + - name: Try to get the canary + uses: dawidd6/action-download-artifact@v2 + with: + github_token: "${{ secrets.GITHUB_TOKEN }}" + workflow: ${{ github.event.workflow_run.workflow_id }} + #workflow: validate-and-build.yml + #run_id: ${{ github.event.workflow_run.id }} + name: tag-canary + path: canary + - name: Check for existence of canary + run: | + #If this file does not exist, then cat will return a nonzero status (failure) + #and the entire workflow will fail + cat canary/tag-canary.txt + + run-appinspect: + runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag] + #Only run when tagged + steps: + + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + #Download the artifacts we want to check + - name: Restore Content-Pack Artifacts for AppInspect testing + uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} + name: content-latest + path: build/ + + + + - name: Install System Packages + run: | + sudo apt update -qq + sudo apt install jq -qq + + + + - name: Submit ESCU Package to AppInspect API + env: + APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} + APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }} + run: | + cd bin + #Enclose in quotes in case there are any special characters in the username/password + #Better not to pass these arguments on the command line, if possible + ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" + + - name: Submit SAAWS Package to AppInspect API + env: + APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} + APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }} + run: | + cd bin + ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" + + - name: Create report artifact + if: always() + run: | + #Always create this, regardless of whether success or failure above + tar -cvzf report.tar.gz report/ + + - name: store_artifacts + uses: actions/upload-artifact@v2 + with: + name: appinspect_reports + path: | + report.tar.gz + + #Still store the report, even if we have failed (otherwise we don't know why/how we failed) + - name: store_artifacts_on_failure + uses: actions/upload-artifact@v2 + if: failure() + with: + name: appinspect_reports_failure + path: | + report.tar.gz + + create-report: + runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag, run-appinspect] + #Only run when tagged + steps: + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + + - name: Install System Packages + run: | + sudo apt update -qq + sudo apt install jq -qq + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: run reporting + run: | + source venv/bin/activate + python3 bin/reporting.py + + #Official, Verified Amazon-AWS Github Account Provided Action + - uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + + - name: Upload Reporting + run: | + aws s3 cp bin/reporting s3://security-content-testing/reporting --recursive --exclude "*" --include "*.svg" + + update-sources-github: + runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report] + #Only run when tagged + steps: + + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} + path: . + name: content-latest + + - name: Stage artifacts in proper directories + run: | + mkdir latest-escu + tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1 + mkdir latest-saaws + tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1 + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 + with: + repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD + path: "cti/" + + - name: Get branch and PR required for detection testing main.py + id: vars + run: | + echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" + + - name: Run doc-gen + run: | + source venv/bin/activate + python3 bin/doc_gen.py --path . --output docs -v + + - name: Make YAMLs Pretty + run: | + source venv/bin/activate + python3 bin/pretty_yaml.py --path . -v + + - name: Run generate-actors-map + run: | + source venv/bin/activate + python3 bin/generate-actors-map.py --projects_path . --output docs/mitre-map/ + + - name: Run generate-coverage-map + run: | + source venv/bin/activate + python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map + + - name: Update github with new docs and package bits + run: | + rm -rf dist + mkdir dist + echo "Directory layout 3" + pwd + ls -lah + mv latest-escu dist/escu + mv latest-saaws dist/saaws + # configure git to prep for commit + #git config credential.helper 'cache --timeout=120' + git config user.email "research@splunk.com" + git config user.name "research bot" + git config --global push.default simple + git add dist/* + git add docs/* + git add detections/* + git commit --allow-empty -m "updating docs and package bits [ci skip]" + # Push quietly to prevent showing the token in log + #No need to provide any credentials + git push + + + publish-github-release: + #Github-maintained release action is in archived state: https://github.com/actions/create-release + #They recommend several and we use the following with the most stars: https://github.com/softprops/action-gh-release + runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report, update-sources-github] + #Only run when tagged + + steps: + + #Get the artifacts that we need + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} + path: . + name: content-latest + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} + path: . + name: appinspect_reports + + #Rename those artifacts appropriately + - name: Set tag + id: vars + run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}" + + - name: Rename the content-update appropriately + run: | + cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz + cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz + + #No checksum on the reports + cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz + + cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt + + #Upload all of the artifacts that we have created using the third party + #action recommended bu Github + - name: Upload Release Artifacts + uses: softprops/action-gh-release@v1 + with: + files: | + DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz + DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz + report-${{ steps.vars.outputs.tag }}.tar.gz + checksum-${{ steps.vars.outputs.tag }}.txt + + + + attack-range-update: + runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report, update-sources-github, publish-github-release] + #Only run when tagged + steps: + + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} + path: . + name: content-latest + + #Official, Verified Amazon-AWS Github Account Provided Action + - uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + + - name: Sync latest ESCU to the Attack Range S3 bucket for apps + run: | + aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries-testing/ + # make the file public since it is not by default + aws s3api put-object-acl --bucket attack-range-appbinaries-testing --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read + + master-api-update: + runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] + #Only run when tagged + steps: + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: Create Baseline Folder + run: | + source venv/bin/activate + python3 bin/create_baseline_folder.py + + #Official, Verified Amazon-AWS Github Account Provided Action + - uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + + - name: Update API sources + run: | + aws s3 rm s3://security-content-testing --recursive --exclude "*" --include "*.yml" + aws s3 cp stories s3://security-content-testing/stories --recursive --exclude "*" --include "*.yml" + aws s3 cp baselines s3://security-content-testing/baselines --recursive --exclude "*" --include "*.yml" + aws s3 cp detections s3://security-content-testing/detections --recursive --exclude "*" --include "*.yml" + aws s3 cp response_tasks s3://security-content-testing/response_tasks --recursive --exclude "*" --include "*.yml" + aws s3 cp responses s3://security-content-testing/responses --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content-testing/lookups --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content-testing/lookups --recursive --exclude "*" --include "*.csv" + aws s3 cp macros s3://security-content-testing/macros --recursive --exclude "*" --include "*.yml" + aws s3 cp deployments s3://security-content-testing/deployments --recursive --exclude "*" --include "*.yml" + - name: Security Content API Smoke Test + run: | + API_URL='https://content.splunkresearch.com/detections' + API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" $API_URL) + echo "Security Content API Status: $API_STATUS" + if [ "$API_STATUS" != "200" ]; then + echo "Error [Security Content API status: $API_STATUS]" + exit 1 + fi + + diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml index c6aa2cede4..9c3ea7cee0 100644 --- a/.github/workflows/semgrep-analysis.yml +++ b/.github/workflows/semgrep-analysis.yml @@ -41,16 +41,15 @@ jobs: # Scan code using project's configuration on https://semgrep.dev/manage - uses: returntocorp/semgrep-action@v1 with: - #The following line is commented out for now pending a fix to the semgrep repo - #generateSarif: "1" + generateSarif: "1" config: >- # more at semgrep.dev/explore p/security-audit p/secrets # Upload SARIF file generated in previous step #The following lines are commented out right now pending a fix to the semgrep repo - # - name: Upload SARIF file - # uses: github/codeql-action/upload-sarif@v1 - # with: - # sarif_file: semgrep.sarif - # if: always() + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: semgrep.sarif + if: always() diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py index 652f3a9d1e..022c2dadcd 100644 --- a/automated_detection_testing/detection_service.py +++ b/automated_detection_testing/detection_service.py @@ -148,7 +148,7 @@ def main(args): detection_obj['tags']['dataset'] = datasets with open(file_path, 'w') as f: - yaml.dump(detection_obj, f, sort_keys=False) + yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True) changed_file_path = 'detections/' + test['detection_result']['detection_file'] security_content_repo_obj.index.add([changed_file_path]) @@ -177,7 +177,7 @@ def main(args): def load_file(file_path): - with open(file_path, 'r') as stream: + with open(file_path, 'r', encoding="utf-8") as stream: try: file = list(yaml.safe_load_all(stream))[0] except yaml.YAMLError as exc: diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 8e3dcc8f44..5182fa1312 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -19,6 +19,7 @@ certifi==2021.5.30 cffi==1.14.5 cfgv==3.3.0 chardet==4.0.0 +colorama==0.4.4 configparser==5.0.2 contextlib2==0.6.0.post1 Deprecated==1.2.12 @@ -55,6 +56,7 @@ PyInquirer==1.0.3 PyJWT==2.1.0 PyNaCl==1.4.0 pyparsing==2.4.7 +pyperclip==1.8.2 pytest==6.2.4 python-daemon==2.3.0 python-dateutil==2.8.1 diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml new file mode 100644 index 0000000000..664e6696d0 --- /dev/null +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -0,0 +1,50 @@ +name: Github Commit Changes In Master +id: c9d2bfe2-019f-11ec-a8eb-acde48001122 +version: 1 +date: '2021-08-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] +description: This search is to detect a pushed or commit to master or main branch. + This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a + PR for review. of course in some cases admin of the project may did a changes directly to master branch +search: '`github` branches{}.name = main OR branches{}.name = master + | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `github_commit_changes_in_master_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to github logs having the fork, commit, push metadata that can be use + to monitor the changes in a github project. +known_false_positives: admin can do changes directly to master branch +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1199 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious commit by $commit.commit.author.email$ to main branch + observable: + - name: commit.commit.author.email + type: User + role: + - attacker + automated_detection_testing: passed diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml new file mode 100644 index 0000000000..75f7b438c7 --- /dev/null +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -0,0 +1,68 @@ +name: Gsuite Email Suspicious Subject With Attachment +id: 8ef3971e-00f2-11ec-b54f-acde48001122 +version: 1 +date: '2021-08-19' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] +description: This search is to detect a gsuite email contains suspicious subject having + known file type used in spear phishing. This technique is a common and effective + entry vector of attacker to compromise a network by luring the user to click or + execute the suspicious attachment send from external email account because of the + effective social engineering of subject related to delivery, bank and so on. On + the other hand this detection may catch a normal email traffic related to legitimate + transaction so better to check the email sender, spelling and etc. avoid click link + or opening the attachment if you are not expecting this type of e-mail. +search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", + "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps + *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type + IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") + | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address + "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" + and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime + max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, + values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size + by destination{}.service num_message_attachments subject destination{}.address + source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `gsuite_email_suspicious_subject_with_attachment_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal user or normal transaction may contain the subject and + file type attachment that this detection try to search. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml new file mode 100644 index 0000000000..35957793cd --- /dev/null +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -0,0 +1,58 @@ +name: Gsuite Email With Known Abuse Web Service Link +id: 8630aa22-042b-11ec-af39-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] +description: This analytics is to detect a gmail containing a link that are known + to be abused by malware or attacker like pastebin, telegram and discord to deliver + malicious payload. This event can encounter some normal email traffic within organization + and external email that normally using this application and services. +search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") + | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address + "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" + and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains + min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address + subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `gsuite_email_with_known_abuse_web_service_link_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal email contains this link that are known application + within the organization or network can be catched by this detection. +references: +- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml new file mode 100644 index 0000000000..dc8efaa7b0 --- /dev/null +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -0,0 +1,71 @@ +name: Gsuite Suspicious Shared File Name +id: 07eed200-03f5-11ec-98fb-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] +description: This search is to detect a shared file in google drive with suspicious + file name that are commonly used by spear phishing campaign. This technique is very + popular to lure the user by running a malicious document or click a malicious link + within the shared file that will redirected to malicious website. This detection + can also catch some normal email communication between organization and its external + customer. +search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" + IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", + "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", + "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", + "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex + field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" + and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime + max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title + parameters.doc_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `gsuite_suspicious_shared_file_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal user or normal transaction may contain the subject and + file type attachment that this detection try to search +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - parameters.doc_title + - src_domain + - dest_domain + - email + - parameters.visibility + - parameters.owner + - parameters.doc_type + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ + observable: + - name: parameters.owner + type: User + role: + - attacker + - name: email + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml new file mode 100644 index 0000000000..b14e3e6ba6 --- /dev/null +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -0,0 +1,55 @@ +name: Kubernetes Nginx Ingress LFI +id: 0f83244b-425b-4528-83db-7a88c5f66e48 +version: 1 +date: '2021-08-20' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from a nginx ingress controller + to detect local file inclusion attacks. +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT + lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as + status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, + url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +- https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/ +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Local File Inclusion Attack detected on $host$ + mitre_attack_id: + - T1212 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - raw + risk_score: 49 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log + diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml new file mode 100644 index 0000000000..9255efa4dc --- /dev/null +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -0,0 +1,54 @@ +name: Kubernetes Nginx Ingress RFI +id: fc5531ae-62fd-4de6-9c36-b4afdae8ca95 +version: 1 +date: '2021-08-23' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from a nginx ingress controller + to detect remote file inclusion attacks. +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | rex field=request "^(?\S+)?\s(?\S+)\s" | rex field=url "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" + | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name + as proxy | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, + dest_ip status, url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +- https://www.netsparker.com/blog/web-security/remote-file-inclusion-vulnerability/ +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Remote File Inclusion Attack detected on $host$ + mitre_attack_id: + - T1212 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - raw + risk_score: 49 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml new file mode 100644 index 0000000000..eac427de91 --- /dev/null +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -0,0 +1,57 @@ +name: Kubernetes Scanner Image Pulling +id: 4890cd6b-0112-4974-a272-c5c153aee551 +version: 1 +date: '2021-08-24' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes + to detect Kubernetes Security Scanner. +search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling + image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") + | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host + | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, + kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `kubernetes_scanner_image_pulling_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Kubernetes Scanner image pulled on host $host$ + mitre_attack_id: + - T1526 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: host + type: Entity + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - object.message + - source.host + - object.involvedObject.name + - object.involvedObject.namespace + - object.involvedObject.kind + - object.message + - object.reason + risk_score: 49 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json + diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 619694db3c..f05fea3a44 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -80,3 +80,4 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + diff --git a/lookups/local_file_inclusion_paths.csv b/lookups/local_file_inclusion_paths.csv new file mode 100644 index 0000000000..f0a0de38a5 --- /dev/null +++ b/lookups/local_file_inclusion_paths.csv @@ -0,0 +1,1009 @@ +local_file_inclusion_paths, lfi_path +*/apache2/logs/access.log*, yes +*/apache2/logs/error.log*, yes +*/apache/conf/httpd.conf*, yes +*/apache/logs/access.log*, yes +*/apache/logs/error.log*, yes +*/apache/php/php.ini*, yes +*/apachephpphp.ini*, yes +*/bin/php.ini*, yes +*/boot/grub/grub.cfg*, yes +*/boot/grub/menu.lst*, yes +*/etc/adduser.conf*, yes +*/etc/alias*, yes +*/etc/apache22/conf/httpd.conf*, yes +*/etc/apache22/httpd.conf*, yes +*/etc/apache2/apache2.conf*, yes +*/etc/apache2/apache.conf*, yes +*/etc/apache2/conf/httpd.conf*, yes +*/etc/apache2/default-server.conf*, yes +*/etc/apache2/envvars*, yes +*/etc/apache2/httpd2.conf*, yes +*/etc/apache2/httpd.conf*, yes +*/etc/apache2/mods-available/autoindex.conf*, yes +*/etc/apache2/mods-available/deflate.conf*, yes +*/etc/apache2/mods-available/dir.conf*, yes +*/etc/apache2/mods-available/mem_cache.conf*, yes +*/etc/apache2/mods-available/mime.conf*, yes +*/etc/apache2/mods-available/proxy.conf*, yes +*/etc/apache2/mods-available/setenvif.conf*, yes +*/etc/apache2/mods-available/ssl.conf*, yes +*/etc/apache2/mods-enabled/alias.conf*, yes +*/etc/apache2/mods-enabled/deflate.conf*, yes +*/etc/apache2/mods-enabled/dir.conf*, yes +*/etc/apache2/mods-enabled/mime.conf*, yes +*/etc/apache2/mods-enabled/negotiation.conf*, yes +*/etc/apache2/mods-enabled/php5.conf*, yes +*/etc/apache2/mods-enabled/status.conf*, yes +*/etc/apache2/ports.conf*, yes +*/etc/apache2/sites-available/default*, yes +*/etc/apache2/sites-available/default-ssl*, yes +*/etc/apache2/sites-enabled/000-default*, yes +*/etc/apache2/sites-enabled/default*, yes +*/etc/apache2/ssl-global.conf*, yes +*/etc/apache/access.conf*, yes +*/etc/apache/apache.conf*, yes +*/etc/apache/conf/httpd.conf*, yes +*/etc/apache/default-server.conf*, yes +*/etc/apache/httpd.conf*, yes +*/etc/apt/apt.conf*, yes +*/etc/avahi/avahi-daemon.conf*, yes +*/etc/bash.bashrc*, yes +*/etc/bluetooth/input.conf*, yes +*/etc/bluetooth/main.conf*, yes +*/etc/bluetooth/network.conf*, yes +*/etc/bluetooth/rfcomm.conf*, yes +*/etc/ca-certificates.conf*, yes +*/etc/ca-certificates.conf.dpkg-old*, yes +*/etc/casper.conf*, yes +*/etc/chkrootkit.conf*, yes +*/etc/chrootUsers*, yes +*/etc/clamav/clamd.conf*, yes +*/etc/clamav/freshclam.conf*, yes +*/etc/crontab*, yes +*/etc/crypttab*, yes +*/etc/cups/acroread.conf*, yes +*/etc/cups/cupsd.conf*, yes +*/etc/cups/cupsd.conf.default*, yes +*/etc/cups/pdftops.conf*, yes +*/etc/cups/printers.conf*, yes +*/etc/cvs-cron.conf*, yes +*/etc/cvs-pserver.conf*, yes +*/etc/debconf.conf*, yes +*/etc/debian_version*, yes +*/etc/default/grub*, yes +*/etc/deluser.conf*, yes +*/etc/dhcp3/dhclient.conf*, yes +*/etc/dhcp3/dhcpd.conf*, yes +*/etc/dhcp/dhclient.conf*, yes +*/etc/dns2tcpd.conf*, yes +*/etc/e2fsck.conf*, yes +*/etc/esound/esd.conf*, yes +*/etc/etter.conf*, yes +*/etc/exports*, yes +*/etc/fedora-release*, yes +*/etc/firewall.rules*, yes +*/etc/foremost.conf*, yes +*/etc/fstab*, yes +*/etc/ftpchroot*, yes +*/etc/ftphosts*, yes +*/etc/ftpusers*, yes +*/etc/fuse.conf*, yes +*/etc/group*, yes +*/etc/group-*, yes +*/etc/hdparm.conf*, yes +*/etc/host.conf*, yes +*/etc/hostname*, yes +*/etc/hosts*, yes +*/etc/hosts.allow*, yes +*/etc/hosts.deny*, yes +*/etc/http/conf/httpd.conf*, yes +*/etc/httpd/apache2.conf*, yes +*/etc/httpd/apache.conf*, yes +*/etc/httpd.conf*, yes +*/etc/httpd/conf*, yes +*/etc/httpd/conf/apache2.conf*, yes +*/etc/httpd/conf/apache.conf*, yes +*/etc/httpd/conf.d*, yes +*/etc/httpd/conf/httpd.conf*, yes +*/etc/httpd/extra/httpd-ssl.conf*, yes +*/etc/httpd/httpd.conf*, yes +*/etc/httpd/logs/acces.log*, yes +*/etc/httpd/logs/acces_log*, yes +*/etc/httpd/logs/access.log*, yes +*/etc/httpd/logs/access_log*, yes +*/etc/httpd/logs/error.log*, yes +*/etc/httpd/logs/error_log*, yes +*/etc/httpd/mod_php.conf*, yes +*/etc/httpd/php.ini*, yes +*/etc/http/httpd.conf*, yes +*/etc/inetd.conf*, yes +*/etc/init.d*, yes +*/etc/inittab*, yes +*/etc/ipfw.conf*, yes +*/etc/ipfw.rules*, yes +*/etc/issue*, yes +*/etc/issue.net*, yes +*/etc/kbd/config*, yes +*/etc/kernel-img.conf*, yes +*/etc/kernel-pkg.conf*, yes +*/etc/ldap/ldap.conf*, yes +*/etc/ld.so.conf*, yes +*/etc/lighttpd/lighthttpd.conf*, yes +*/etc/login.defs*, yes +*/etc/logrotate.conf*, yes +*/etc/ltrace.conf*, yes +*/etc/mail/sendmail.conf*, yes +*/etc/mandrake-release*, yes +*/etc/manpath.config*, yes +*/etc/miredo.conf*, yes +*/etc/miredo/miredo.conf*, yes +*/etc/miredo/miredo-server.conf*, yes +*/etc/miredo-server.conf*, yes +*/etc/modules*, yes +*/etc/mono/config*, yes +*/etc/motd*, yes +*/etc/mtab*, yes +*/etc/mtools.conf*, yes +*/etc/muddleftpd.com*, yes +*/etc/muddleftpd/muddleftpd.conf*, yes +*/etc/muddleftpd/muddleftpd.passwd*, yes +*/etc/muddleftpd/mudlog*, yes +*/etc/muddleftpd/mudlogd.conf*, yes +*/etc/muddleftpd/passwd*, yes +*/etc/my.cnf*, yes +*/etc/mysql/my.cnf*, yes +*/etc/networks*, yes +*/etc/nginx/nginx.conf*, yes +*/etc/openldap/ldap.conf*, yes +*/etc/os-release*, yes +*/etc/osxhttpd/osxhttpd.conf*, yes +*/etc/pam.conf*, yes +*/etc/passwd*, yes +*/etc/passwd-*, yes +*/etc/passwd~*, yes +*/etc/password.master*, yes +*/etc/php4/apache2/php.ini*, yes +*/etc/php4/apache/php.ini*, yes +*/etc/php4/cgi/php.ini*, yes +*/etc/php5/apache2/php.ini*, yes +*/etc/php5/apache/php.ini*, yes +*/etc/php5/cgi/php.ini*, yes +*/etc/php/apache2/php.ini*, yes +*/etc/php/apache/php.ini*, yes +*/etc/php/cgi/php.ini*, yes +*/etc/php.ini*, yes +*/etc/phpmyadmin/config.inc.php*, yes +*/etc/php/php4/php.ini*, yes +*/etc/php/php.ini*, yes +*/etc/postgresql/pg_hba.conf*, yes +*/etc/postgresql/postgresql.conf*, yes +*/etc/profile*, yes +*/etc/proftp.conf*, yes +*/etc/proftpd/modules.conf*, yes +*/etc/protpd/proftpd.conf*, yes +*/etc/pulse/client.conf*, yes +*/etc/pure-ftpd.conf*, yes +*/etc/pureftpd.passwd*, yes +*/etc/pureftpd.pdb*, yes +*/etc/pure-ftpd/pure-ftpd.conf*, yes +*/etc/pure-ftpd/pure-ftpd.pdb*, yes +*/etc/pure-ftpd/pureftpd.pdb*, yes +*/etc/rc.conf*, yes +*/etc/redhat-release*, yes +*/etc/resolv.conf*, yes +*/etc/samba/dhcp.conf*, yes +*/etc/samba/netlogon*, yes +*/etc/samba/private/smbpasswd*, yes +*/etc/samba/samba.conf*, yes +*/etc/samba/smb.conf*, yes +*/etc/samba/smb.conf.user*, yes +*/etc/samba/smbpasswd*, yes +*/etc/samba/smbusers*, yes +*/etc/security/access.conf*, yes +*/etc/security/environ*, yes +*/etc/security/failedlogin*, yes +*/etc/security/group*, yes +*/etc/security/group.conf*, yes +*/etc/security/lastlog*, yes +*/etc/security/limits*, yes +*/etc/security/limits.conf*, yes +*/etc/security/namespace.conf*, yes +*/etc/security/opasswd*, yes +*/etc/security/pam_env.conf*, yes +*/etc/security/passwd*, yes +*/etc/security/passwd*, yes +*/etc/security/sepermit.conf*, yes +*/etc/security/time.conf*, yes +*/etc/security/user*, yes +*/etc/sensors3.conf*, yes +*/etc/sensors.conf*, yes +*/etc/shadow*, yes +*/etc/shadow-*, yes +*/etc/shadow~*, yes +*/etc/slackware-release*, yes +*/etc/smb.conf*, yes +*/etc/smbpasswd*, yes +*/etc/smi.conf*, yes +*/etc/squirrelmail/apache.conf*, yes +*/etc/squirrelmail/config/config.php*, yes +*/etc/squirrelmail/config_default.php*, yes +*/etc/squirrelmail/config_local.php*, yes +*/etc/squirrelmail/config.php*, yes +*/etc/squirrelmail/default_pref*, yes +*/etc/squirrelmail/filters_setup.php*, yes +*/etc/squirrelmail/index.php*, yes +*/etc/squirrelmail/sqspell_config.php*, yes +*/etc/ssh/sshd_config*, yes +*/etc/sso/sso_config.ini*, yes +*/etc/stunnel/stunnel.conf*, yes +*/etc/sudoers*, yes +*/etc/SUSE-release*, yes +*/etc/sysconfig/network-scripts/ifcfg-eth0*, yes +*/etc/sysctl.conf*, yes +*/etc/syslog.conf*, yes +*/etc/timezone*, yes +*/etc/tinyproxy/tinyproxy.conf*, yes +*/etc/tor/tor-tsocks.conf*, yes +*/etc/tsocks.conf*, yes +*/etc/updatedb.conf*, yes +*/etc/updatedb.conf.BeforeVMwareToolsInstall*, yes +*/etc/utmp*, yes +*/etc/vhcs2/proftpd/proftpd.conf*, yes +*/etc/vmware-tools/config*, yes +*/etc/vmware-tools/tpvmlp.conf*, yes +*/etc/vmware-tools/vmware-tools-libraries.conf*, yes +*/etc/vsftpd.chroot_list*, yes +*/etc/vsftpd.conf*, yes +*/etc/vsftpd/vsftpd.conf*, yes +*/etc/webmin/miniserv.conf*, yes +*/etc/webmin/miniserv.users*, yes +*/etc/wicd/dhclient.conf.template.default*, yes +*/etc/wicd/manager-settings.conf*, yes +*/etc/wicd/wired-settings.conf*, yes +*/etc/wicd/wireless-settings.conf*, yes +*/etc/wu-ftpd/ftpaccess*, yes +*/etc/wu-ftpd/ftphosts*, yes +*/etc/wu-ftpd/ftpusers*, yes +*/etc/X11/xorg.conf*, yes +*/etc/X11/xorg.conf.BeforeVMwareToolsInstall*, yes +*/etc/X11/xorg.conf.orig*, yes +*/etc/X11/xorg.conf-vesa*, yes +*/etc/X11/xorg.conf-vmware*, yes +*/home2/bin/stable/apache/php.ini*, yes +*/home2binstableapachephp.ini*, yes +*/home/bin/stable/apache/php.ini*, yes +*/homebinstableapachephp.ini*, yes +*/home/postgres/data/pg_hba.conf*, yes +*/home/postgres/data/pg_ident.conf*, yes +*/home/postgres/data/PG_VERSION*, yes +*/home/postgres/data/postgresql.conf*, yes +*/home/user/lighttpd/lighttpd.conf*, yes +*/http/httpd.conf*, yes +*/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/[JBOSS]/server/default/conf/jndi.properties*, yes +*/[JBOSS]/server/default/conf/log4j.xml*, yes +*/[JBOSS]/server/default/conf/login-config.xml*, yes +*/[JBOSS]/server/default/conf/server.log.properties*, yes +*/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/[JBOSS]/server/default/log/boot.log*, yes +*/[JBOSS]/server/default/log/server.log*, yes +*/Library/WebServer/Documents/default.htm*, yes +*/Library/WebServer/Documents/default.html*, yes +*/Library/WebServer/Documents/default.php*, yes +*/Library/WebServer/Documents/.htaccess*, yes +*/Library/WebServer/Documents/index.htm*, yes +*/Library/WebServer/Documents/index.html*, yes +*/Library/WebServer/Documents/index.php*, yes +*/logs/access.log*, yes +*/logs/access_log*, yes +*/logs/error.log*, yes +*/logs/error_log*, yes +*/logs/pure-ftpd.log*, yes +*/logs/security_debug_log*, yes +*/logs/security_log*, yes +*/mysql/bin/my.ini*, yes +*/MySQL/data/{HOST}.err*, yes +*/MySQL/data/mysql-bin.index*, yes +*/MySQL/data/mysql-bin.log*, yes +*/MySQL/data/mysql.err*, yes +*/MySQL/data/mysql.log*, yes +*/MySQL/my.cnf*, yes +*/MySQL/my.ini*, yes +*/NetServer/bin/stable/apache/php.ini*, yes +*/NetServerbinstableapachephp.ini*, yes +*/opt/apache22/conf/httpd.conf*, yes +*/opt/apache2/apache2.conf*, yes +*/opt/apache2/apache.conf*, yes +*/opt/apache2/conf/apache2.conf*, yes +*/opt/apache2/conf/apache.conf*, yes +*/opt/apache2/conf/httpd.conf*, yes +*/opt/apache/apache2.conf*, yes +*/opt/apache/apache.conf*, yes +*/opt/apache/conf/apache2.conf*, yes +*/opt/apache/conf/apache.conf*, yes +*/opt/apache/conf/httpd.conf*, yes +*/opt/httpd/apache2.conf*, yes +*/opt/httpd/apache.conf*, yes +*/opt/httpd/conf/apache2.conf*, yes +*/opt/httpd/conf/apache.conf*, yes +*/opt/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/opt/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/opt/[JBOSS]/server/default/conf/jndi.properties*, yes +*/opt/[JBOSS]/server/default/conf/log4j.xml*, yes +*/opt/[JBOSS]/server/default/conf/login-config.xml*, yes +*/opt/[JBOSS]/server/default/conf/server.log.properties*, yes +*/opt/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/opt/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/opt/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/opt/[JBOSS]/server/default/log/boot.log*, yes +*/opt/[JBOSS]/server/default/log/server.log*, yes +*/opt/lampp/etc/httpd.conf*, yes +*/opt/lampp/logs/access.log*, yes +*/opt/lampp/logs/access_log*, yes +*/opt/lampp/logs/error.log*, yes +*/opt/lampp/logs/error_log*, yes +*/opt/lsws/conf/httpd_conf.xml*, yes +*/opt/lsws/logs/access.log*, yes +*/opt/lsws/logs/error.log*, yes +*/opt/tomcat/logs/catalina.err*, yes +*/opt/tomcat/logs/catalina.out*, yes +*/opt/xampp/etc/php.ini*, yes +*/opt/xampp/logs/access.log*, yes +*/opt/xampp/logs/access_log*, yes +*/opt/xampp/logs/error.log*, yes +*/opt/xampp/logs/error_log*, yes +*/private/etc/httpd/apache2.conf*, yes +*/private/etc/httpd/apache.conf*, yes +*/private/etc/httpd/httpd.conf*, yes +*/private/etc/httpd/httpd.conf.default*, yes +*/private/etc/squirrelmail/config/config.php*, yes +*/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/jndi.properties*, yes +*/private/tmp/[JBOSS]/server/default/conf/log4j.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/login-config.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/server.log.properties*, yes +*/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/private/tmp/[JBOSS]/server/default/log/boot.log*, yes +*/private/tmp/[JBOSS]/server/default/log/server.log*, yes +*/proc/cpuinfo*, yes +*/proc/devices*, yes +*/proc/meminfo*, yes +*/proc/net/tcp*, yes +*/proc/net/udp*, yes +*/proc/self/cmdline*, yes +*/proc/self/environ*, yes +*/proc/self/mounts*, yes +*/proc/self/stat*, yes +*/proc/self/status*, yes +*/proc/version*, yes +*/Program Files/Apache Group/Apache2/conf/apache2.conf*, yes +*/Program Files/Apache Group/Apache2/conf/apache.conf*, yes +*/Program Files/Apache Group/Apache2/conf/httpd.conf*, yes +*/Program FilesApache GroupApache2confhttpd.conf*, yes +*/Program Files/Apache Group/Apache/apache2.conf*, yes +*/Program Files/Apache Group/Apache/apache.conf*, yes +*/Program Files/Apache Group/Apache/conf/apache2.conf*, yes +*/Program Files/Apache Group/Apache/conf/apache.conf*, yes +*/Program Files/Apache Group/Apache/conf/httpd.conf*, yes +*/Program FilesApache GroupApacheconfhttpd.conf*, yes +*/Program Files/Apache Group/Apache/logs/access.log*, yes +*/Program FilesApache GroupApachelogsaccess.log*, yes +*/Program Files/Apache Group/Apache/logs/error.log*, yes +*/Program FilesApache GroupApachelogserror.log*, yes +*/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/jndi.properties*, yes +*/Program Files/[JBOSS]/server/default/conf/log4j.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/login-config.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/server.log.properties*, yes +*/Program Files/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/Program Files/[JBOSS]/server/default/log/boot.log*, yes +*/Program Files/[JBOSS]/server/default/log/server.log*, yes +*/Program Files/MySQL/data/{HOST}.err*, yes +*/Program Files/MySQL/data/mysql-bin.index*, yes +*/Program Files/MySQL/data/mysql-bin.log*, yes +*/Program Files/MySQL/data/mysql.err*, yes +*/Program Files/MySQL/data/mysql.log*, yes +*/Program Files/MySQL/my.cnf*, yes +*/Program Files/MySQL/my.ini*, yes +*/Program Files/Vidalia Bundle/Polipo/polipo.conf*, yes +*/Program Files/xampp/apache/conf/apache2.conf*, yes +*/Program Files/xampp/apache/conf/apache.conf*, yes +*/Program Files/xampp/apache/conf/httpd.conf*, yes +*/Program Filesxamppapacheconfhttpd.conf*, yes +*/root/.bash_config*, yes +*/root/.bash_history*, yes +*/root/.bash_logout*, yes +*/root/.bashrc*, yes +*/root/.ksh_history*, yes +*/root/.Xauthority*, yes +*/srv/www/htdos/squirrelmail/config/config.php*, yes +*/tmp/access.log*, yes +*/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/tmp/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/tmp/[JBOSS]/server/default/conf/jndi.properties*, yes +*/tmp/[JBOSS]/server/default/conf/log4j.xml*, yes +*/tmp/[JBOSS]/server/default/conf/login-config.xml*, yes +*/tmp/[JBOSS]/server/default/conf/server.log.properties*, yes +*/tmp/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/tmp/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/tmp/[JBOSS]/server/default/log/boot.log*, yes +*/tmp/[JBOSS]/server/default/log/server.log*, yes +*/usr/apache2/conf/httpd.conf*, yes +*/usr/apache/conf/httpd.conf*, yes +*/usr/etc/pure-ftpd.conf*, yes +*/usr/home/user/lighttpd/lighttpd.conf*, yes +*/usr/home/user/var/log/apache.log*, yes +*/usr/home/user/var/log/lighttpd.error.log*, yes +*/usr/internet/pgsql/data/pg_hba.conf*, yes +*/usr/internet/pgsql/data/postmaster.log*, yes +*/usr/lib/cron/log*, yes +*/usr/lib/php.ini*, yes +*/usr/lib/php/php.ini*, yes +*/usr/lib/security/mkuser.default*, yes +*/usr/local/apache22/conf/httpd.conf*, yes +*/usr/local/apache22/httpd.conf*, yes +*/usr/local/apache2/apache2.conf*, yes +*/usr/local/apache2/apache.conf*, yes +*/usr/local/apache2/conf/apache2.conf*, yes +*/usr/local/apache2/conf/apache.conf*, yes +*/usr/local/apache2/conf/extra/httpd-ssl.conf*, yes +*/usr/local/apache2/conf/httpd.conf*, yes +*/usr/local/apache2/conf/modsec.conf*, yes +*/usr/local/apache2/conf/ssl.conf*, yes +*/usr/local/apache2/conf/vhosts.conf*, yes +*/usr/local/apache2/conf/vhosts-custom.conf*, yes +*/usr/local/apache2/httpd.conf*, yes +*/usr/local/apache2/logs/access.log*, yes +*/usr/local/apache2/logs/access_log*, yes +*/usr/local/apache2/logs/audit_log*, yes +*/usr/local/apache2/logs/error.log*, yes +*/usr/local/apache2/logs/error_log*, yes +*/usr/local/apache2/logs/lighttpd.error.log*, yes +*/usr/local/apache2/logs/lighttpd.log*, yes +*/usr/local/apache/apache2.conf*, yes +*/usr/local/apache/apache.conf*, yes +*/usr/local/apache/conf/access.conf*, yes +*/usr/local/apache/conf/apache2.conf*, yes +*/usr/local/apache/conf/apache.conf*, yes +*/usr/local/apache/conf/httpd.conf*, yes +*/usr/local/apache/conf/httpd.conf.default*, yes +*/usr/local/apache/conf/modsec.conf*, yes +*/usr/local/apache/conf/php.ini*, yes +*/usr/local/apache/conf/vhosts.conf*, yes +*/usr/local/apache/conf/vhosts-custom.conf*, yes +*/usr/local/apache/httpd.conf*, yes +*/usr/local/apache/logs/access.log*, yes +*/usr/local/apache/logs/access_log*, yes +*/usr/local/apache/logs/audit_log*, yes +*/usr/local/apache/logs/error.log*, yes +*/usr/local/apache/logs/error_log*, yes +*/usr/local/apache/logs/lighttpd.error.log*, yes +*/usr/local/apache/logs/lighttpd.log*, yes +*/usr/local/apache/logs/mod_jk.log*, yes +*/usr/local/apps/apache22/conf/httpd.conf*, yes +*/usr/local/apps/apache2/conf/httpd.conf*, yes +*/usr/local/apps/apache/conf/httpd.conf*, yes +*/usr/local/cpanel/logs*, yes +*/usr/local/cpanel/logs/access_log*, yes +*/usr/local/cpanel/logs/error_log*, yes +*/usr/local/cpanel/logs/license_log*, yes +*/usr/local/cpanel/logs/login_log*, yes +*/usr/local/cpanel/logs/stats_log*, yes +*/usr/local/etc/apache22/conf/httpd.conf*, yes +*/usr/local/etc/apache22/httpd.conf*, yes +*/usr/local/etc/apache2/conf/httpd.conf*, yes +*/usr/local/etc/apache2/httpd.conf*, yes +*/usr/local/etc/apache2/vhosts.conf*, yes +*/usr/local/etc/apache/conf/httpd.conf*, yes +*/usr/local/etc/apache/httpd.conf*, yes +*/usr/local/etc/apache/vhosts.conf*, yes +*/usr/local/etc/httpd/conf*, yes +*/usr/local/etc/httpd/conf/httpd.conf*, yes +*/usr/local/etc/lighttpd.conf*, yes +*/usr/local/etc/lighttpd.conf.new*, yes +*/usr/local/etc/nginx/nginx.conf*, yes +*/usr/local/etc/php.ini*, yes +*/usr/local/etc/pure-ftpd.conf*, yes +*/usr/local/etc/pureftpd.pdb*, yes +*/usr/local/etc/smb.conf*, yes +*/usr/local/etc/webmin/miniserv.conf*, yes +*/usr/local/etc/webmin/miniserv.users*, yes +*/usr/local/httpd/conf/httpd.conf*, yes +*/usr/local/jakarta/dist/tomcat/conf/context.xml*, yes +*/usr/local/jakarta/dist/tomcat/conf/jakarta.conf*, yes +*/usr/local/jakarta/dist/tomcat/conf/logging.properties*, yes +*/usr/local/jakarta/dist/tomcat/conf/server.xml*, yes +*/usr/local/jakarta/dist/tomcat/conf/workers.properties*, yes +*/usr/local/jakarta/dist/tomcat/logs/mod_jk.log*, yes +*/usr/local/jakarta/tomcat/conf/context.xml*, yes +*/usr/local/jakarta/tomcat/conf/jakarta.conf*, yes +*/usr/local/jakarta/tomcat/conf/logging.properties*, yes +*/usr/local/jakarta/tomcat/conf/server.xml*, yes +*/usr/local/jakarta/tomcat/conf/workers.properties*, yes +*/usr/local/jakarta/tomcat/logs/catalina.err*, yes +*/usr/local/jakarta/tomcat/logs/catalina.out*, yes +*/usr/local/jakarta/tomcat/logs/mod_jk.log*, yes +*/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/jndi.properties*, yes +*/usr/local/[JBOSS]/server/default/conf/log4j.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/login-config.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/server.log.properties*, yes +*/usr/local/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/usr/local/[JBOSS]/server/default/log/boot.log*, yes +*/usr/local/[JBOSS]/server/default/log/server.log*, yes +*/usr/local/lib/php.ini*, yes +*/usr/local/lighttpd/conf/lighttpd.conf*, yes +*/usr/local/lighttpd/log/access.log*, yes +*/usr/local/lighttpd/log/lighttpd.error.log*, yes +*/usr/local/logs/access.log*, yes +*/usr/local/logs/samba.log*, yes +*/usr/local/lsws/conf/httpd_conf.xml*, yes +*/usr/local/lsws/logs/error.log*, yes +*/usr/local/mysql/data/{HOST}.err*, yes +*/usr/local/mysql/data/mysql-bin.index*, yes +*/usr/local/mysql/data/mysql-bin.log*, yes +*/usr/local/mysql/data/mysqlderror.log*, yes +*/usr/local/mysql/data/mysql.err*, yes +*/usr/local/mysql/data/mysql.log*, yes +*/usr/local/mysql/data/mysql-slow.log*, yes +*/usr/local/nginx/conf/nginx.conf*, yes +*/usr/local/pgsql/bin/pg_passwd*, yes +*/usr/local/pgsql/data/passwd*, yes +*/usr/local/pgsql/data/pg_hba.conf*, yes +*/usr/local/pgsql/data/pg_log*, yes +*/usr/local/pgsql/data/postgresql.conf*, yes +*/usr/local/pgsql/data/postgresql.log*, yes +*/usr/local/php4/apache2.conf*, yes +*/usr/local/php4/apache2.conf.php*, yes +*/usr/local/php4/apache.conf*, yes +*/usr/local/php4/apache.conf.php*, yes +*/usr/local/php4/httpd.conf*, yes +*/usr/local/php4/httpd.conf.php*, yes +*/usr/local/php4/lib/php.ini*, yes +*/usr/local/php5/apache2.conf*, yes +*/usr/local/php5/apache2.conf.php*, yes +*/usr/local/php5/apache.conf*, yes +*/usr/local/php5/apache.conf.php*, yes +*/usr/local/php5/httpd.conf*, yes +*/usr/local/php5/httpd.conf.php*, yes +*/usr/local/php5/lib/php.ini*, yes +*/usr/local/php/apache2.conf*, yes +*/usr/local/php/apache2.conf.php*, yes +*/usr/local/php/apache.conf*, yes +*/usr/local/php/apache.conf.php*, yes +*/usr/local/php/httpd.conf*, yes +*/usr/local/php/httpd.conf.php*, yes +*/usr/local/php/lib/php.ini*, yes +*/usr/local/psa/admin/conf/php.ini*, yes +*/usr/local/psa/admin/conf/site_isolation_settings.ini*, yes +*/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php*, yes +*/usr/local/psa/admin/logs/httpsd_access_log*, yes +*/usr/local/psa/admin/logs/panel.log*, yes +*/usr/local/pureftpd/etc/pure-ftpd.conf*, yes +*/usr/local/pureftpd/etc/pureftpd.pdb*, yes +*/usr/local/pureftpd/sbin/pure-config.pl*, yes +*/usr/local/samba/lib/log.user*, yes +*/usr/local/samba/lib/smb.conf.user*, yes +*/usr/local/sb/config*, yes +*/usr/local/Zend/etc/php.ini*, yes +*/usr/local/zeus/web/global.cfg*, yes +*/usr/local/zeus/web/log/errors*, yes +*/usr/pkg/etc/httpd/httpd.conf*, yes +*/usr/pkg/etc/httpd/httpd-default.conf*, yes +*/usr/pkg/etc/httpd/httpd-vhosts.conf*, yes +*/usr/pkgsrc/net/pureftpd/*, yes +*/usr/pkgsrc/net/pureftpd/pure-ftpd.conf*, yes +*/usr/pkgsrc/net/pureftpd/pureftpd.passwd*, yes +*/usr/pkgsrc/net/pureftpd/pureftpd.pdb*, yes +*/usr/ports/contrib/pure-ftpd/*, yes +*/usr/ports/contrib/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/contrib/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/contrib/pure-ftpd/pureftpd.pdb*, yes +*/usr/ports/ftp/pure-ftpd/*, yes +*/usr/ports/ftp/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/ftp/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/ftp/pure-ftpd/pureftpd.pdb*, yes +*/usr/ports/net/pure-ftpd/*, yes +*/usr/ports/net/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/net/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/net/pure-ftpd/pureftpd.pdb*, yes +*/usr/sbin/mudlogd*, yes +*/usr/sbin/mudpasswd*, yes +*/usr/sbin/pure-config.pl*, yes +*/usr/share/adduser/adduser.conf*, yes +*/usr/share/logs/catalina.err*, yes +*/usr/share/logs/catalina.out*, yes +*/usr/share/squirrelmail/config/config.php*, yes +*/usr/share/squirrelmail/plugins/squirrel_logger/setup.php*, yes +*/usr/share/tomcat6/conf/context.xml*, yes +*/usr/share/tomcat6/conf/logging.properties*, yes +*/usr/share/tomcat6/conf/server.xml*, yes +*/usr/share/tomcat6/conf/workers.properties*, yes +*/usr/share/tomcat6/logs/catalina.err*, yes +*/usr/share/tomcat6/logs/catalina.out*, yes +*/usr/share/tomcat/logs/catalina.err*, yes +*/usr/share/tomcat/logs/catalina.out*, yes +*/usr/spool/lp/log*, yes +*/usr/spool/mqueue/syslog*, yes +*/var/adm/acct/sum/loginlog*, yes +*/var/adm/aculog*, yes +*/var/adm/aculogs*, yes +*/var/adm/crash/unix*, yes +*/var/adm/crash/vmcore*, yes +*/var/adm/cron/log*, yes +*/var/adm/dtmp*, yes +*/var/adm/lastlog/username*, yes +*/var/adm/log/asppp.log*, yes +*/var/adm/loginlog*, yes +*/var/adm/log/xferlog*, yes +*/var/adm/lp/lpd-errs*, yes +*/var/adm/messages*, yes +*/var/adm/pacct*, yes +*/var/adm/qacct*, yes +*/var/adm/ras/bootlog*, yes +*/var/adm/ras/errlog*, yes +*/var/adm/sulog*, yes +*/var/adm/SYSLOG*, yes +*/var/adm/utmp*, yes +*/var/adm/utmpx*, yes +*/var/adm/vold.log*, yes +*/var/adm/wtmp*, yes +*/var/adm/wtmpx*, yes +*/var/adm/X0msgs*, yes +*/var/apache/conf/httpd.conf*, yes +*/var/cpanel/cpanel.config*, yes +*/var/cpanel/tomcat.options*, yes +*/var/cron/log*, yes +*/var/data/mysql-bin.index*, yes +*/var/lib/mysql/my.cnf*, yes +*/var/lib/pgsql/data/postgresql.conf*, yes +*/var/lib/squirrelmail/prefs/squirrelmail.log*, yes +*/var/lighttpd.log*, yes +*/var/local/www/conf/php.ini*, yes +*/var/log/access.log*, yes +*/var/log/access_log*, yes +*/var/log/apache2/access.log*, yes +*/var/log/apache2/access_log*, yes +*/var/log/apache2/error.log*, yes +*/var/log/apache2/error_log*, yes +*/var/log/apache2/squirrelmail.err.log*, yes +*/var/log/apache2/squirrelmail.log*, yes +*/var/log/apache/access.log*, yes +*/var/log/apache/access_log*, yes +*/var/log/apache/error.log*, yes +*/var/log/apache/error_log*, yes +*/var/log/auth.log*, yes +*/var/log/authlog*, yes +*/var/log/boot.log*, yes +*/var/log/cron/var/log/postgres.log*, yes +*/var/log/daemon.log*, yes +*/var/log/daemon.log.1*, yes +*/var/log/data/mysql-bin.index*, yes +*/var/log/dmessage*, yes +*/var/log/error.log*, yes +*/var/log/error_log*, yes +*/var/log/exim/mainlog*, yes +*/var/log/exim_mainlog*, yes +*/var/log/exim/paniclog*, yes +*/var/log/exim_paniclog*, yes +*/var/log/exim/rejectlog*, yes +*/var/log/exim_rejectlog*, yes +*/var/log/ftplog*, yes +*/var/log/ftp-proxy*, yes +*/var/log/ftp-proxy/ftp-proxy.log*, yes +*/var/log/httpd-access.log*, yes +*/var/log/httpd/access.log*, yes +*/var/log/httpd/access_log*, yes +*/var/log/httpd/error.log*, yes +*/var/log/httpd/error_log*, yes +*/var/log/ipfw*, yes +*/var/log/ipfw/ipfw.log*, yes +*/var/log/ipfw.log*, yes +*/var/log/ipfw.today*, yes +*/var/log/kern.log*, yes +*/var/log/kern.log.1*, yes +*/var/log/lighttpd/*, yes +*/var/log/lighttpd.access.log*, yes +*/var/log/lighttpd/access.log*, yes +*/var/log/lighttpd/access.www.log*, yes +*/var/log/lighttpd/{DOMAIN}/access.log*, yes +*/var/log/lighttpd/{DOMAIN}/error.log*, yes +*/var/log/lighttpd.error.log*, yes +*/var/log/lighttpd/error.log*, yes +*/var/log/lighttpd/error.www.log*, yes +*/var/log/log.smb*, yes +*/var/log/mail.err*, yes +*/var/log/mail.info*, yes +*/var/log/mail.log*, yes +*/var/log/maillog*, yes +*/var/log/mail.warn*, yes +*/var/log/messages*, yes +*/var/log/messages.1*, yes +*/var/log/muddleftpd*, yes +*/var/log/muddleftpd.conf*, yes +*/var/log/mysql-bin.index*, yes +*/var/log/mysql/data/mysql-bin.index*, yes +*/var/log/mysqlderror.log*, yes +*/var/log/mysql.err*, yes +*/var/log/mysql.log*, yes +*/var/log/mysql/mysql-bin.index*, yes +*/var/log/mysql/mysql-bin.log*, yes +*/var/log/mysql/mysql.log*, yes +*/var/log/mysql/mysql-slow.log*, yes +*/var/log/news.all*, yes +*/var/log/news/news.all*, yes +*/var/log/news/news.crit*, yes +*/var/log/news/news.err*, yes +*/var/log/news/news.notice*, yes +*/var/log/news/suck.err*, yes +*/var/log/news/suck.notice*, yes +*/var/log/nginx.access_log*, yes +*/var/log/nginx/access.log*, yes +*/var/log/nginx/access_log*, yes +*/var/log/nginx.error_log*, yes +*/var/log/nginx/error.log*, yes +*/var/log/nginx/error_log*, yes +*/var/log/pgsql8.log*, yes +*/var/log/pgsql_log*, yes +*/var/log/pgsql/pgsql.log*, yes +*/var/log/pm-powersave.log*, yes +*/var/log/POPlog*, yes +*/var/log/postgres/pg_backup.log*, yes +*/var/log/postgres/postgres.log*, yes +*/var/log/postgresql.log*, yes +*/var/log/postgresql/main.log*, yes +*/var/log/postgresql/postgres.log*, yes +*/var/log/postgresql/postgresql-8.1-main.log*, yes +*/var/log/postgresql/postgresql-8.3-main.log*, yes +*/var/log/postgresql/postgresql-8.4-main.log*, yes +*/var/log/postgresql/postgresql-9.0-main.log*, yes +*/var/log/postgresql/postgresql-9.1-main.log*, yes +*/var/log/postgresql/postgresql.log*, yes +*/var/log/proftpd*, yes +*/var/log/proftpd.access_log*, yes +*/var/log/proftpd.xferlog*, yes +*/var/log/proftpd/xferlog.legacy*, yes +*/var/log/pureftpd.log*, yes +*/var/log/pure-ftpd/pure-ftpd.log*, yes +*/var/logs/access.log*, yes +*/var/log/samba.log*, yes +*/var/log/samba.log1*, yes +*/var/log/samba.log2*, yes +*/var/log/samba/log.nmbd*, yes +*/var/log/samba/log.smbd*, yes +*/var/log/squirrelmail.log*, yes +*/var/log/sso/sso.log*, yes +*/var/log/sw-cp-server/error_log*, yes +*/var/log/syslog*, yes +*/var/log/syslog.1*, yes +*/var/log/tomcat6/catalina.out*, yes +*/var/log/ufw.log*, yes +*/var/log/user.log*, yes +*/var/log/user.log.1*, yes +*/var/log/vmware/hostd-1.log*, yes +*/var/log/vmware/hostd.log*, yes +*/var/log/vsftpd.log*, yes +*/var/log/webmin/miniserv.log*, yes +*/var/log/xferlog*, yes +*/var/log/Xorg.0.log*, yes +*/var/lp/logs/lpNet*, yes +*/var/lp/logs/lpsched*, yes +*/var/lp/logs/requests*, yes +*/var/mail/root*, yes +*/var/mysql-bin.index*, yes +*/var/mysql.log*, yes +*/var/nm2/postgresql.conf*, yes +*/var/postgresql/db/postgresql.conf*, yes +*/var/postgresql/log/postgresql.log*, yes +*/var/saf/_log*, yes +*/var/saf/port/log*, yes +*/var/spool/cron/crontabs/root*, yes +*/var/spool/cron/crontabs/root*, yes +*/var/www/conf*, yes +*/var/www/conf/httpd.conf*, yes +*/var/www/html/squirrelmail/config/config.php*, yes +*/var/www/.lighttpdpassword*, yes +*/var/www/logs/access.log*, yes +*/var/www/logs/access_log*, yes +*/var/www/logs/error.log*, yes +*/var/www/logs/error_log*, yes +*/var/www/squirrelmail/config/config.php*, yes +*/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini*, yes +*/Volumes/webBackup/opt/apache2/conf/httpd.conf*, yes +*/Volumes/webBackup/private/etc/httpd/httpd.conf*, yes +*/Volumes/webBackup/private/etc/httpd/httpd.conf.default*, yes +*/wamp/bin/apache/apache2.2.21/conf/httpd.conf*, yes +*/wamp/bin/apache/apache2.2.21/logs/access.log*, yes +*/wamp/bin/apache/apache2.2.21/logs/error.log*, yes +*/wamp/bin/apache/apache2.2.21/wampserver.conf*, yes +*/wamp/bin/apache/apache2.2.22/conf/httpd.conf*, yes +*/wamp/bin/apache/apache2.2.22/conf/wampserver.conf*, yes +*/wamp/bin/apache/apache2.2.22/logs/access.log*, yes +*/wamp/bin/apache/apache2.2.22/logs/error.log*, yes +*/wamp/bin/apache/apache2.2.22/wampserver.conf*, yes +*/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index*, yes +*/wamp/bin/mysql/mysql5.5.16/my.ini*, yes +*/wamp/bin/mysql/mysql5.5.16/wampserver.conf*, yes +*/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index*, yes +*/wamp/bin/mysql/mysql5.5.24/my.ini*, yes +*/wamp/bin/mysql/mysql5.5.24/wampserver.conf*, yes +*/wamp/logs/access.log*, yes +*/wamp/logs/apache_error.log*, yes +*/wamp/logs/genquery.log*, yes +*/wamp/logs/mysql.log*, yes +*/wamp/logs/slowquery.log*, yes +*/web/conf/php.ini*, yes +*/WINDOWS/php.ini*, yes +*/WINDOWSphp.ini*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC1*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC2*, yes +*/WINDOWS/system32/logfiles/SMTPSVC*, yes +*/WINDOWS/system32/logfiles/SMTPSVC1*, yes +*/WINDOWS/system32/logfiles/SMTPSVC2*, yes +*/WINDOWS/system32/logfiles/SMTPSVC3*, yes +*/WINDOWS/system32/logfiles/SMTPSVC4*, yes +*/WINDOWS/system32/logfiles/SMTPSVC5*, yes +*/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log*, yes +*/WINNT/php.ini*, yes +*/WINNTphp.ini*, yes +*/WINNT/system32/logfiles/MSFTPSVC*, yes +*/WINNT/system32/logfiles/MSFTPSVC1*, yes +*/WINNT/system32/logfiles/MSFTPSVC2*, yes +*/WINNT/system32/logfiles/SMTPSVC*, yes +*/WINNT/system32/logfiles/SMTPSVC1*, yes +*/WINNT/system32/logfiles/SMTPSVC2*, yes +*/WINNT/system32/logfiles/SMTPSVC3*, yes +*/WINNT/system32/logfiles/SMTPSVC4*, yes +*/WINNT/system32/logfiles/SMTPSVC5*, yes +*/WINNT/system32/logfiles/W3SVC1/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC2/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC3/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC/inetsvn1.log*, yes +*/www/apache/conf/httpd.conf*, yes +*/www/conf/httpd.conf*, yes +*/www/logs/freebsddiary-access_log*, yes +*/www/logs/freebsddiary-error.log*, yes +*/www/logs/proftpd.system.log*, yes +*/xampp/apache/bin/php.ini*, yes +*/xamppapachebinphp.ini*, yes +*/xampp/apache/conf/httpd.conf*, yes +*/xampp/apache/logs/access.log*, yes +*/xampp/apache/logs/error.log*, yes +*/xampp/FileZillaFTP/FileZilla Server.xml*, yes +*/xampp/htdocs/aca.txt*, yes +*/xampp/htdocs/admin.php*, yes +*/xampp/htdocs/leer.txt*, yes +*/xampp/MercuryMail/mercury.ini*, yes +*/xampp/mysql/data/{HOST}.err*, yes +*/xampp/mysql/data/mysql-bin.index*, yes +*/xampp/mysql/data/mysql.err*, yes +*/xampp/phpMyAdmin/config.inc.php*, yes +*/xampp/php/php.ini*, yes +*/xampp/sendmail/sendmail.ini*, yes +*/xampp/sendmail/sendmail.log*, yes +*/xampp/webalizer/webalizer.conf*, yes +*/proc/self/fd/0*, yes +*/proc/self/fd/1*, yes +*/proc/self/fd/2*, yes +*/proc/self/fd/3*, yes +*/proc/self/fd/4*, yes +*/proc/self/fd/5*, yes +*/proc/self/fd/6*, yes +*/proc/self/fd/7*, yes +*/proc/self/fd/8*, yes +*/proc/self/fd/9*, yes +*/proc/self/fd/10*, yes +*/proc/self/fd/11*, yes +*/proc/self/fd/12*, yes +*/proc/self/fd/13*, yes +*/proc/self/fd/14*, yes +*/proc/self/fd/15*, yes +*/proc/self/fd/16*, yes +*/proc/self/fd/17*, yes +*/proc/self/fd/18*, yes +*/proc/self/fd/19*, yes +*/proc/self/fd/20*, yes +*/proc/self/fd/21*, yes +*/proc/self/fd/22*, yes +*/proc/self/fd/23*, yes +*/proc/self/fd/24*, yes +*/proc/self/fd/25*, yes +*/proc/self/fd/26*, yes +*/proc/self/fd/27*, yes +*/proc/self/fd/28*, yes +*/proc/self/fd/29*, yes +*/proc/self/fd/30*, yes +*/proc/self/fd/31*, yes +*/proc/self/fd/32*, yes +*/proc/self/fd/33*, yes +*/proc/self/fd/34*, yes +*/proc/self/fd/35*, yes +*/proc/self/fd/36*, yes +*/proc/self/fd/37*, yes +*/proc/self/fd/38*, yes +*/proc/self/fd/39*, yes +*/proc/self/fd/40*, yes +*/proc/self/fd/41*, yes +*/proc/self/fd/42*, yes +*/proc/self/fd/43*, yes +*/proc/self/fd/44*, yes +*/proc/self/fd/45*, yes +*/proc/self/fd/46*, yes +*/proc/self/fd/47*, yes +*/proc/self/fd/48*, yes +*/proc/self/fd/49*, yes +*/proc/self/fd/50*, yes +*/proc/self/fd/51*, yes +*/proc/self/fd/52*, yes +*/proc/self/fd/53*, yes +*/proc/self/fd/54*, yes +*/proc/self/fd/55*, yes +*/proc/self/fd/56*, yes +*/proc/self/fd/57*, yes +*/proc/self/fd/58*, yes +*/proc/self/fd/59*, yes +*/proc/self/fd/60*, yes +*/proc/self/fd/61*, yes +*/proc/self/fd/62*, yes +*/proc/self/fd/63*, yes +*/proc/self/fd/64*, yes +*/proc/self/fd/65*, yes +*/proc/self/fd/66*, yes +*/proc/self/fd/67*, yes +*/proc/self/fd/68*, yes +*/proc/self/fd/69*, yes +*/proc/self/fd/70*, yes +*/proc/self/fd/71*, yes +*/proc/self/fd/72*, yes +*/proc/self/fd/73*, yes +*/proc/self/fd/74*, yes +*/proc/self/fd/75*, yes +*/proc/self/fd/76*, yes +*/proc/self/fd/77*, yes +*/proc/self/fd/78*, yes +*/proc/self/fd/79*, yes +*/proc/self/fd/80*, yes +*/proc/self/fd/81*, yes +*/proc/self/fd/82*, yes +*/proc/self/fd/83*, yes +*/proc/self/fd/84*, yes +*/proc/self/fd/85*, yes +*/proc/self/fd/86*, yes +*/proc/self/fd/87*, yes +*/proc/self/fd/88*, yes +*/proc/self/fd/89*, yes +*/proc/self/fd/90*, yes +*/proc/self/fd/91*, yes +*/proc/self/fd/92*, yes +*/proc/self/fd/93*, yes +*/proc/self/fd/94*, yes +*/proc/self/fd/95*, yes +*/proc/self/fd/96*, yes +*/proc/self/fd/97*, yes +*/proc/self/fd/98*, yes +*/proc/self/fd/99*, yes +*/proc/self/fd/100*, yes \ No newline at end of file diff --git a/lookups/local_file_inclusion_paths.yml b/lookups/local_file_inclusion_paths.yml new file mode 100644 index 0000000000..e08394bf85 --- /dev/null +++ b/lookups/local_file_inclusion_paths.yml @@ -0,0 +1,7 @@ +description: A list of interesting files in a local file inclusion attack +filename: local_file_inclusion_paths.csv +name: local_file_inclusion_paths +default_match: 'false' +match_type: WILDCARD(local_file_inclusion_paths) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/macros/github.yml b/macros/github.yml new file mode 100644 index 0000000000..5064aa92ed --- /dev/null +++ b/macros/github.yml @@ -0,0 +1,4 @@ +definition: sourcetype=aws:firehose:json +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: github \ No newline at end of file diff --git a/macros/kube_objects_events.yml b/macros/kube_objects_events.yml new file mode 100644 index 0000000000..ae4dd70960 --- /dev/null +++ b/macros/kube_objects_events.yml @@ -0,0 +1,4 @@ +definition: sourcetype=kube:objects:events +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: kube_objects_events diff --git a/macros/kubernetes_container_controller.yml b/macros/kubernetes_container_controller.yml new file mode 100644 index 0000000000..29793801b8 --- /dev/null +++ b/macros/kubernetes_container_controller.yml @@ -0,0 +1,3 @@ +definition: sourcetype=kube:container:controller +description: customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent. +name: kubernetes_container_controller diff --git a/tests/cloud/github_commit_changes_in_master.test.yml b/tests/cloud/github_commit_changes_in_master.test.yml new file mode 100644 index 0000000000..6901948db5 --- /dev/null +++ b/tests/cloud/github_commit_changes_in_master.test.yml @@ -0,0 +1,12 @@ +name: Github Commit Changes In Master Unit Test +tests: +- name: Github Commit Changes In Master + file: cloud/github_commit_changes_in_master.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: github_push_master.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log + source: github + sourcetype: aws:firehose:json \ No newline at end of file diff --git a/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml new file mode 100644 index 0000000000..bd6e1a260c --- /dev/null +++ b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Email Suspicious Subject With Attachment Unit Test +tests: +- name: Gsuite Email Suspicious Subject With Attachment + file: cloud/gsuite_email_suspicious_subject_with_attachment.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gsuite_susp_subj_attach.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml new file mode 100644 index 0000000000..d8161f3f21 --- /dev/null +++ b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Email With Known Abuse Web Service Link Unit Test +tests: +- name: Gsuite Email With Known Abuse Web Service Link + file: cloud/gsuite_email_with_known_abuse_web_service_link.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gsuite_susp_url.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file diff --git a/tests/cloud/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml new file mode 100644 index 0000000000..70297baf7d --- /dev/null +++ b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Suspicious Shared File Name Unit Test +tests: +- name: Gsuite Suspicious Shared File Name + file: cloud/gsuite_suspicious_shared_file_name.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gdrive_susp_attach.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log + source: http:gsuite + sourcetype: gsuite:drive:json \ No newline at end of file diff --git a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml new file mode 100644 index 0000000000..756ad99e29 --- /dev/null +++ b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Nginx Ingress LFI Unit Test +tests: +- name: Kubernetes Nginx Ingress LFI + file: cloud/kubernetes_nginx_ingress_lfi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_nginx_lfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log + sourcetype: kube:container:controller + source: kubernetes diff --git a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml new file mode 100644 index 0000000000..792162624c --- /dev/null +++ b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Nginx Ingress RFI Unit Test +tests: +- name: Kubernetes Nginx Ingress RFI + file: cloud/kubernetes_nginx_ingress_rfi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_nginx_rfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + sourcetype: kube:container:controller + source: kubernetes diff --git a/tests/cloud/kubernetes_scanner_image_pulling.test.yml b/tests/cloud/kubernetes_scanner_image_pulling.test.yml new file mode 100644 index 0000000000..5d8b50443a --- /dev/null +++ b/tests/cloud/kubernetes_scanner_image_pulling.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Scanner Image Pulling Unit Test +tests: +- name: Kubernetes Scanner Image Pulling + file: cloud/kubernetes_scanner_image_pulling.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_kube_hunter.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json + sourcetype: kube:objects:events + source: kubernetes