From a7f7f0b090d37f0cac4613ffc9a8296fbc044815 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 19 Aug 2021 15:45:36 +0200 Subject: [PATCH 01/70] dev_sec2 --- ...ail_suspicious_subject_with_attachment.yml | 64 +++++++++++++++++++ ...uspicious_subject_with_attachment.test.yml | 12 ++++ 2 files changed, 76 insertions(+) create mode 100644 detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml create mode 100644 tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml new file mode 100644 index 0000000000..830034e639 --- /dev/null +++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml @@ -0,0 +1,64 @@ +name: Gsuite Email Suspicious Subject With Attachment +id: 8ef3971e-00f2-11ec-b54f-acde48001122 +version: 1 +date: '2021-08-19' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +- Email +- Updates +description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. + This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment + send from external email account. +search: '`gsuite_gmail` num_message_attachments > 0 + subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) + attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) + | rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by + destination{}.service num_message_attachments subject destination{}.address source.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_suspicious_subject_with_attachment_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal user or normal transaction may contain the subject and file type attachment that + this detection try to search. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml new file mode 100644 index 0000000000..0e535c5fae --- /dev/null +++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Email Suspicious Subject With Attachment Unit Test +tests: +- name: Gsuite Email Suspicious Subject With Attachment + file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From ea29a11c37154013506c12a8576ce0f7ac98cb8e Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 20 Aug 2021 10:40:33 +0200 Subject: [PATCH 02/70] dev_sec2 --- ...gsuite_email_suspicious_subject_with_attachment.yml | 8 +++++--- ...e_email_suspicious_subject_with_attachment.test.yml | 10 +++++----- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml index 830034e639..99ca5cfd98 100644 --- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml @@ -9,8 +9,10 @@ datamodel: - Email - Updates description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. - This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment - send from external email account. + This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment + send from external email account because of the effective social engineering of subject related to delivery, bank and so on. + On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. + avoid click link or opening the attachment if you are not expecting this type of e-mail. search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) @@ -33,7 +35,7 @@ tags: analytic_story: - DevSecOps dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml index 0e535c5fae..c3cb0a32c8 100644 --- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml +++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -1,12 +1,12 @@ name: Gsuite Email Suspicious Subject With Attachment Unit Test tests: - name: Gsuite Email Suspicious Subject With Attachment - file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml + file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: gsuite_susp_subj_attach.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file From e5ae722014b8038cd91847e6353bf37e1d507fb2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 20 Aug 2021 13:59:06 +0200 Subject: [PATCH 03/70] dev_git --- .../github_commit_changes_in_master.yml | 52 +++++++++++++++++++ macros/github.yml | 4 ++ .../github_commit_changes_in_master.test.yml | 12 +++++ 3 files changed, 68 insertions(+) create mode 100644 detections/endpoint/github_commit_changes_in_master.yml create mode 100644 macros/github.yml create mode 100644 tests/endpoint/github_commit_changes_in_master.test.yml diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml new file mode 100644 index 0000000000..b06ba23f25 --- /dev/null +++ b/detections/endpoint/github_commit_changes_in_master.yml @@ -0,0 +1,52 @@ +name: Github Commit Changes In Master +id: c9d2bfe2-019f-11ec-a8eb-acde48001122 +version: 1 +date: '2021-08-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect a pushed or commit to master or main branch. + This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a + PR for review. of course in some cases admin of the project may did a changes directly to master branch +search: 'index=github branches{}.name = main + | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `github_commit_changes_in_master_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project. +known_false_positives: admin can do changes directly to master branch +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious commit by $commit.commit.author.email$ to main branch + observable: + - name: commit.commit.author.email + type: User + role: + - attacker + + \ No newline at end of file diff --git a/macros/github.yml b/macros/github.yml new file mode 100644 index 0000000000..686cb4d1bf --- /dev/null +++ b/macros/github.yml @@ -0,0 +1,4 @@ +definition: sourcetype="aws:firehose:json" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: github \ No newline at end of file diff --git a/tests/endpoint/github_commit_changes_in_master.test.yml b/tests/endpoint/github_commit_changes_in_master.test.yml new file mode 100644 index 0000000000..56ca796b5b --- /dev/null +++ b/tests/endpoint/github_commit_changes_in_master.test.yml @@ -0,0 +1,12 @@ +name: Github Commit Changes In Master Unit Test +tests: +- name: Github Commit Changes In Master + file: detections/endpoint/github_commit_changes_in_master.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 89fb2682b0b8b995bbdffbcb4c71da1e27027538 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 20 Aug 2021 14:09:49 +0200 Subject: [PATCH 04/70] dev_git --- detections/endpoint/github_commit_changes_in_master.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml index b06ba23f25..698eaeddc4 100644 --- a/detections/endpoint/github_commit_changes_in_master.yml +++ b/detections/endpoint/github_commit_changes_in_master.yml @@ -9,7 +9,7 @@ datamodel: description: This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch -search: 'index=github branches{}.name = main +search: '`github` branches{}.name = main | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From b0c2e80271e35842477a097542d4031c42475b3b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 09:06:58 +0200 Subject: [PATCH 05/70] dev_git --- .../endpoint/github_commit_changes_in_master.yml | 4 ++-- .../endpoint/github_commit_changes_in_master.test.yml | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml index 698eaeddc4..86bf3bfb84 100644 --- a/detections/endpoint/github_commit_changes_in_master.yml +++ b/detections/endpoint/github_commit_changes_in_master.yml @@ -23,11 +23,11 @@ tags: analytic_story: - DevSecOps dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log kill_chain_phases: - Exploitation mitre_attack_id: - - T1003.002 + - T1199 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/tests/endpoint/github_commit_changes_in_master.test.yml b/tests/endpoint/github_commit_changes_in_master.test.yml index 56ca796b5b..0c1039d1b2 100644 --- a/tests/endpoint/github_commit_changes_in_master.test.yml +++ b/tests/endpoint/github_commit_changes_in_master.test.yml @@ -1,12 +1,12 @@ name: Github Commit Changes In Master Unit Test tests: - name: Github Commit Changes In Master - file: detections/endpoint/github_commit_changes_in_master.yml + file: endpoint/github_commit_changes_in_master.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: github_push_master.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log + source: github + sourcetype: aws:firehose:json \ No newline at end of file From 749df5935705c1e36ddd7d408b721b5887248f55 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 10:17:40 +0200 Subject: [PATCH 06/70] new detection --- .../cloud/kubernetes_nginx_ingress_lfi.yml | 47 + lookups/local_file_inclusion_paths.csv | 1009 +++++++++++++++++ lookups/local_file_inclusion_paths.yml | 7 + macros/kubernetes_container_controller.yml | 3 + 4 files changed, 1066 insertions(+) create mode 100644 detections/cloud/kubernetes_nginx_ingress_lfi.yml create mode 100644 lookups/local_file_inclusion_paths.csv create mode 100644 lookups/local_file_inclusion_paths.yml create mode 100644 macros/kubernetes_container_controller.yml diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml new file mode 100644 index 0000000000..85dd0bf5a6 --- /dev/null +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -0,0 +1,47 @@ +name: Kubernetes Nginx Ingress LFI +id: 0f83244b-425b-4528-83db-7a88c5f66e48 +version: 1 +date: '2021-08-20' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from a nginx ingress controller to + detect local file inclusion attacks. +search: '`kubernetes_container_controller` +| rex field=_raw "^(?\S+)\s+-\s+(?\S+)\s+\[(?[^\]]*+)\]\s+\"\s*(?[^\s\"]+)\s+(?\S+)\s+(?\S+)\"\s+(?\S+)\s+(?\S+)\s\"(?[^\"]*+)\"\s\"(?[^\"]*+)\"\s(?\S+)\s(?\S+)\s\[(?[^\]]+)\]\s\[(?[^\]]*+)\]\s(?\S+)\s+(?\S+)\s(?\S+)\s(?\S+)\s+(?[^\s]+)" +| `kubernetes_nginx_ingress_lfi_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +- https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/ +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Local File Inclusion Attack detected on + mitre_attack_id: + - T1212 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - raw + risk_score: 49 + security_domain: network diff --git a/lookups/local_file_inclusion_paths.csv b/lookups/local_file_inclusion_paths.csv new file mode 100644 index 0000000000..b46be5720d --- /dev/null +++ b/lookups/local_file_inclusion_paths.csv @@ -0,0 +1,1009 @@ +local_file_inclusion_paths +/apache2/logs/access.log +/apache2/logs/error.log +/apache/conf/httpd.conf +/apache/logs/access.log +/apache/logs/error.log +/apache/php/php.ini +/apachephpphp.ini +/bin/php.ini +/boot/grub/grub.cfg +/boot/grub/menu.lst +/etc/adduser.conf +/etc/alias +/etc/apache22/conf/httpd.conf +/etc/apache22/httpd.conf +/etc/apache2/apache2.conf +/etc/apache2/apache.conf +/etc/apache2/conf/httpd.conf +/etc/apache2/default-server.conf +/etc/apache2/envvars +/etc/apache2/httpd2.conf +/etc/apache2/httpd.conf +/etc/apache2/mods-available/autoindex.conf +/etc/apache2/mods-available/deflate.conf +/etc/apache2/mods-available/dir.conf +/etc/apache2/mods-available/mem_cache.conf +/etc/apache2/mods-available/mime.conf +/etc/apache2/mods-available/proxy.conf +/etc/apache2/mods-available/setenvif.conf +/etc/apache2/mods-available/ssl.conf +/etc/apache2/mods-enabled/alias.conf +/etc/apache2/mods-enabled/deflate.conf +/etc/apache2/mods-enabled/dir.conf +/etc/apache2/mods-enabled/mime.conf +/etc/apache2/mods-enabled/negotiation.conf +/etc/apache2/mods-enabled/php5.conf +/etc/apache2/mods-enabled/status.conf +/etc/apache2/ports.conf +/etc/apache2/sites-available/default +/etc/apache2/sites-available/default-ssl +/etc/apache2/sites-enabled/000-default +/etc/apache2/sites-enabled/default +/etc/apache2/ssl-global.conf +/etc/apache/access.conf +/etc/apache/apache.conf +/etc/apache/conf/httpd.conf +/etc/apache/default-server.conf +/etc/apache/httpd.conf +/etc/apt/apt.conf +/etc/avahi/avahi-daemon.conf +/etc/bash.bashrc +/etc/bluetooth/input.conf +/etc/bluetooth/main.conf +/etc/bluetooth/network.conf +/etc/bluetooth/rfcomm.conf +/etc/ca-certificates.conf +/etc/ca-certificates.conf.dpkg-old +/etc/casper.conf +/etc/chkrootkit.conf +/etc/chrootUsers +/etc/clamav/clamd.conf +/etc/clamav/freshclam.conf +/etc/crontab +/etc/crypttab +/etc/cups/acroread.conf +/etc/cups/cupsd.conf +/etc/cups/cupsd.conf.default +/etc/cups/pdftops.conf +/etc/cups/printers.conf +/etc/cvs-cron.conf +/etc/cvs-pserver.conf +/etc/debconf.conf +/etc/debian_version +/etc/default/grub +/etc/deluser.conf +/etc/dhcp3/dhclient.conf +/etc/dhcp3/dhcpd.conf +/etc/dhcp/dhclient.conf +/etc/dns2tcpd.conf +/etc/e2fsck.conf +/etc/esound/esd.conf +/etc/etter.conf +/etc/exports +/etc/fedora-release +/etc/firewall.rules +/etc/foremost.conf +/etc/fstab +/etc/ftpchroot +/etc/ftphosts +/etc/ftpusers +/etc/fuse.conf +/etc/group +/etc/group- +/etc/hdparm.conf +/etc/host.conf +/etc/hostname +/etc/hosts +/etc/hosts.allow +/etc/hosts.deny +/etc/http/conf/httpd.conf +/etc/httpd/apache2.conf +/etc/httpd/apache.conf +/etc/httpd.conf +/etc/httpd/conf +/etc/httpd/conf/apache2.conf +/etc/httpd/conf/apache.conf +/etc/httpd/conf.d +/etc/httpd/conf/httpd.conf +/etc/httpd/extra/httpd-ssl.conf +/etc/httpd/httpd.conf +/etc/httpd/logs/acces.log +/etc/httpd/logs/acces_log +/etc/httpd/logs/access.log +/etc/httpd/logs/access_log +/etc/httpd/logs/error.log +/etc/httpd/logs/error_log +/etc/httpd/mod_php.conf +/etc/httpd/php.ini +/etc/http/httpd.conf +/etc/inetd.conf +/etc/init.d +/etc/inittab +/etc/ipfw.conf +/etc/ipfw.rules +/etc/issue +/etc/issue.net +/etc/kbd/config +/etc/kernel-img.conf +/etc/kernel-pkg.conf +/etc/ldap/ldap.conf +/etc/ld.so.conf +/etc/lighttpd/lighthttpd.conf +/etc/login.defs +/etc/logrotate.conf +/etc/ltrace.conf +/etc/mail/sendmail.conf +/etc/mandrake-release +/etc/manpath.config +/etc/miredo.conf +/etc/miredo/miredo.conf +/etc/miredo/miredo-server.conf +/etc/miredo-server.conf +/etc/modules +/etc/mono/config +/etc/motd +/etc/mtab +/etc/mtools.conf +/etc/muddleftpd.com +/etc/muddleftpd/muddleftpd.conf +/etc/muddleftpd/muddleftpd.passwd +/etc/muddleftpd/mudlog +/etc/muddleftpd/mudlogd.conf +/etc/muddleftpd/passwd +/etc/my.cnf +/etc/mysql/my.cnf +/etc/networks +/etc/nginx/nginx.conf +/etc/openldap/ldap.conf +/etc/os-release +/etc/osxhttpd/osxhttpd.conf +/etc/pam.conf +/etc/passwd +/etc/passwd- +/etc/passwd~ +/etc/password.master +/etc/php4/apache2/php.ini +/etc/php4/apache/php.ini +/etc/php4/cgi/php.ini +/etc/php5/apache2/php.ini +/etc/php5/apache/php.ini +/etc/php5/cgi/php.ini +/etc/php/apache2/php.ini +/etc/php/apache/php.ini +/etc/php/cgi/php.ini +/etc/php.ini +/etc/phpmyadmin/config.inc.php +/etc/php/php4/php.ini +/etc/php/php.ini +/etc/postgresql/pg_hba.conf +/etc/postgresql/postgresql.conf +/etc/profile +/etc/proftp.conf +/etc/proftpd/modules.conf +/etc/protpd/proftpd.conf +/etc/pulse/client.conf +/etc/pure-ftpd.conf +/etc/pureftpd.passwd +/etc/pureftpd.pdb +/etc/pure-ftpd/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.pdb +/etc/pure-ftpd/pureftpd.pdb +/etc/rc.conf +/etc/redhat-release +/etc/resolv.conf +/etc/samba/dhcp.conf +/etc/samba/netlogon +/etc/samba/private/smbpasswd +/etc/samba/samba.conf +/etc/samba/smb.conf +/etc/samba/smb.conf.user +/etc/samba/smbpasswd +/etc/samba/smbusers +/etc/security/access.conf +/etc/security/environ +/etc/security/failedlogin +/etc/security/group +/etc/security/group.conf +/etc/security/lastlog +/etc/security/limits +/etc/security/limits.conf +/etc/security/namespace.conf +/etc/security/opasswd +/etc/security/pam_env.conf +/etc/security/passwd +/etc/security/passwd +/etc/security/sepermit.conf +/etc/security/time.conf +/etc/security/user +/etc/sensors3.conf +/etc/sensors.conf +/etc/shadow +/etc/shadow- +/etc/shadow~ +/etc/slackware-release +/etc/smb.conf +/etc/smbpasswd +/etc/smi.conf +/etc/squirrelmail/apache.conf +/etc/squirrelmail/config/config.php +/etc/squirrelmail/config_default.php +/etc/squirrelmail/config_local.php +/etc/squirrelmail/config.php +/etc/squirrelmail/default_pref +/etc/squirrelmail/filters_setup.php +/etc/squirrelmail/index.php +/etc/squirrelmail/sqspell_config.php +/etc/ssh/sshd_config +/etc/sso/sso_config.ini +/etc/stunnel/stunnel.conf +/etc/sudoers +/etc/SUSE-release +/etc/sysconfig/network-scripts/ifcfg-eth0 +/etc/sysctl.conf +/etc/syslog.conf +/etc/timezone +/etc/tinyproxy/tinyproxy.conf +/etc/tor/tor-tsocks.conf +/etc/tsocks.conf +/etc/updatedb.conf +/etc/updatedb.conf.BeforeVMwareToolsInstall +/etc/utmp +/etc/vhcs2/proftpd/proftpd.conf +/etc/vmware-tools/config +/etc/vmware-tools/tpvmlp.conf +/etc/vmware-tools/vmware-tools-libraries.conf +/etc/vsftpd.chroot_list +/etc/vsftpd.conf +/etc/vsftpd/vsftpd.conf +/etc/webmin/miniserv.conf +/etc/webmin/miniserv.users +/etc/wicd/dhclient.conf.template.default +/etc/wicd/manager-settings.conf +/etc/wicd/wired-settings.conf +/etc/wicd/wireless-settings.conf +/etc/wu-ftpd/ftpaccess +/etc/wu-ftpd/ftphosts +/etc/wu-ftpd/ftpusers +/etc/X11/xorg.conf +/etc/X11/xorg.conf.BeforeVMwareToolsInstall +/etc/X11/xorg.conf.orig +/etc/X11/xorg.conf-vesa +/etc/X11/xorg.conf-vmware +/home2/bin/stable/apache/php.ini +/home2binstableapachephp.ini +/home/bin/stable/apache/php.ini +/homebinstableapachephp.ini +/home/postgres/data/pg_hba.conf +/home/postgres/data/pg_ident.conf +/home/postgres/data/PG_VERSION +/home/postgres/data/postgresql.conf +/home/user/lighttpd/lighttpd.conf +/http/httpd.conf +/[JBOSS]/server/default/conf/jboss-minimal.xml +/[JBOSS]/server/default/conf/jboss-service.xml +/[JBOSS]/server/default/conf/jndi.properties +/[JBOSS]/server/default/conf/log4j.xml +/[JBOSS]/server/default/conf/login-config.xml +/[JBOSS]/server/default/conf/server.log.properties +/[JBOSS]/server/default/conf/standardjaws.xml +/[JBOSS]/server/default/conf/standardjboss.xml +/[JBOSS]/server/default/deploy/jboss-logging.xml +/[JBOSS]/server/default/log/boot.log +/[JBOSS]/server/default/log/server.log +/Library/WebServer/Documents/default.htm +/Library/WebServer/Documents/default.html +/Library/WebServer/Documents/default.php +/Library/WebServer/Documents/.htaccess +/Library/WebServer/Documents/index.htm +/Library/WebServer/Documents/index.html +/Library/WebServer/Documents/index.php +/logs/access.log +/logs/access_log +/logs/error.log +/logs/error_log +/logs/pure-ftpd.log +/logs/security_debug_log +/logs/security_log +/mysql/bin/my.ini +/MySQL/data/{HOST}.err +/MySQL/data/mysql-bin.index +/MySQL/data/mysql-bin.log +/MySQL/data/mysql.err +/MySQL/data/mysql.log +/MySQL/my.cnf +/MySQL/my.ini +/NetServer/bin/stable/apache/php.ini +/NetServerbinstableapachephp.ini +/opt/apache22/conf/httpd.conf +/opt/apache2/apache2.conf +/opt/apache2/apache.conf +/opt/apache2/conf/apache2.conf +/opt/apache2/conf/apache.conf +/opt/apache2/conf/httpd.conf +/opt/apache/apache2.conf +/opt/apache/apache.conf +/opt/apache/conf/apache2.conf +/opt/apache/conf/apache.conf +/opt/apache/conf/httpd.conf +/opt/httpd/apache2.conf +/opt/httpd/apache.conf +/opt/httpd/conf/apache2.conf +/opt/httpd/conf/apache.conf +/opt/[JBOSS]/server/default/conf/jboss-minimal.xml +/opt/[JBOSS]/server/default/conf/jboss-service.xml +/opt/[JBOSS]/server/default/conf/jndi.properties +/opt/[JBOSS]/server/default/conf/log4j.xml +/opt/[JBOSS]/server/default/conf/login-config.xml +/opt/[JBOSS]/server/default/conf/server.log.properties +/opt/[JBOSS]/server/default/conf/standardjaws.xml +/opt/[JBOSS]/server/default/conf/standardjboss.xml +/opt/[JBOSS]/server/default/deploy/jboss-logging.xml +/opt/[JBOSS]/server/default/log/boot.log +/opt/[JBOSS]/server/default/log/server.log +/opt/lampp/etc/httpd.conf +/opt/lampp/logs/access.log +/opt/lampp/logs/access_log +/opt/lampp/logs/error.log +/opt/lampp/logs/error_log +/opt/lsws/conf/httpd_conf.xml +/opt/lsws/logs/access.log +/opt/lsws/logs/error.log +/opt/tomcat/logs/catalina.err +/opt/tomcat/logs/catalina.out +/opt/xampp/etc/php.ini +/opt/xampp/logs/access.log +/opt/xampp/logs/access_log +/opt/xampp/logs/error.log +/opt/xampp/logs/error_log +/private/etc/httpd/apache2.conf +/private/etc/httpd/apache.conf +/private/etc/httpd/httpd.conf +/private/etc/httpd/httpd.conf.default +/private/etc/squirrelmail/config/config.php +/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml +/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml +/private/tmp/[JBOSS]/server/default/conf/jndi.properties +/private/tmp/[JBOSS]/server/default/conf/log4j.xml +/private/tmp/[JBOSS]/server/default/conf/login-config.xml +/private/tmp/[JBOSS]/server/default/conf/server.log.properties +/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml +/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml +/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml +/private/tmp/[JBOSS]/server/default/log/boot.log +/private/tmp/[JBOSS]/server/default/log/server.log +/proc/cpuinfo +/proc/devices +/proc/meminfo +/proc/net/tcp +/proc/net/udp +/proc/self/cmdline +/proc/self/environ +/proc/self/mounts +/proc/self/stat +/proc/self/status +/proc/version +/Program Files/Apache Group/Apache2/conf/apache2.conf +/Program Files/Apache Group/Apache2/conf/apache.conf +/Program Files/Apache Group/Apache2/conf/httpd.conf +/Program FilesApache GroupApache2confhttpd.conf +/Program Files/Apache Group/Apache/apache2.conf +/Program Files/Apache Group/Apache/apache.conf +/Program Files/Apache Group/Apache/conf/apache2.conf +/Program Files/Apache Group/Apache/conf/apache.conf +/Program Files/Apache Group/Apache/conf/httpd.conf +/Program FilesApache GroupApacheconfhttpd.conf +/Program Files/Apache Group/Apache/logs/access.log +/Program FilesApache GroupApachelogsaccess.log +/Program Files/Apache Group/Apache/logs/error.log +/Program FilesApache GroupApachelogserror.log +/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml +/Program Files/[JBOSS]/server/default/conf/jboss-service.xml +/Program Files/[JBOSS]/server/default/conf/jndi.properties +/Program Files/[JBOSS]/server/default/conf/log4j.xml +/Program Files/[JBOSS]/server/default/conf/login-config.xml +/Program Files/[JBOSS]/server/default/conf/server.log.properties +/Program Files/[JBOSS]/server/default/conf/standardjaws.xml +/Program Files/[JBOSS]/server/default/conf/standardjboss.xml +/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml +/Program Files/[JBOSS]/server/default/log/boot.log +/Program Files/[JBOSS]/server/default/log/server.log +/Program Files/MySQL/data/{HOST}.err +/Program Files/MySQL/data/mysql-bin.index +/Program Files/MySQL/data/mysql-bin.log +/Program Files/MySQL/data/mysql.err +/Program Files/MySQL/data/mysql.log +/Program Files/MySQL/my.cnf +/Program Files/MySQL/my.ini +/Program Files/Vidalia Bundle/Polipo/polipo.conf +/Program Files/xampp/apache/conf/apache2.conf +/Program Files/xampp/apache/conf/apache.conf +/Program Files/xampp/apache/conf/httpd.conf +/Program Filesxamppapacheconfhttpd.conf +/root/.bash_config +/root/.bash_history +/root/.bash_logout +/root/.bashrc +/root/.ksh_history +/root/.Xauthority +/srv/www/htdos/squirrelmail/config/config.php +/tmp/access.log +/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml +/tmp/[JBOSS]/server/default/conf/jboss-service.xml +/tmp/[JBOSS]/server/default/conf/jndi.properties +/tmp/[JBOSS]/server/default/conf/log4j.xml +/tmp/[JBOSS]/server/default/conf/login-config.xml +/tmp/[JBOSS]/server/default/conf/server.log.properties +/tmp/[JBOSS]/server/default/conf/standardjaws.xml +/tmp/[JBOSS]/server/default/conf/standardjboss.xml +/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml +/tmp/[JBOSS]/server/default/log/boot.log +/tmp/[JBOSS]/server/default/log/server.log +/usr/apache2/conf/httpd.conf +/usr/apache/conf/httpd.conf +/usr/etc/pure-ftpd.conf +/usr/home/user/lighttpd/lighttpd.conf +/usr/home/user/var/log/apache.log +/usr/home/user/var/log/lighttpd.error.log +/usr/internet/pgsql/data/pg_hba.conf +/usr/internet/pgsql/data/postmaster.log +/usr/lib/cron/log +/usr/lib/php.ini +/usr/lib/php/php.ini +/usr/lib/security/mkuser.default +/usr/local/apache22/conf/httpd.conf +/usr/local/apache22/httpd.conf +/usr/local/apache2/apache2.conf +/usr/local/apache2/apache.conf +/usr/local/apache2/conf/apache2.conf +/usr/local/apache2/conf/apache.conf +/usr/local/apache2/conf/extra/httpd-ssl.conf +/usr/local/apache2/conf/httpd.conf +/usr/local/apache2/conf/modsec.conf +/usr/local/apache2/conf/ssl.conf +/usr/local/apache2/conf/vhosts.conf +/usr/local/apache2/conf/vhosts-custom.conf +/usr/local/apache2/httpd.conf +/usr/local/apache2/logs/access.log +/usr/local/apache2/logs/access_log +/usr/local/apache2/logs/audit_log +/usr/local/apache2/logs/error.log +/usr/local/apache2/logs/error_log +/usr/local/apache2/logs/lighttpd.error.log +/usr/local/apache2/logs/lighttpd.log +/usr/local/apache/apache2.conf +/usr/local/apache/apache.conf +/usr/local/apache/conf/access.conf +/usr/local/apache/conf/apache2.conf +/usr/local/apache/conf/apache.conf +/usr/local/apache/conf/httpd.conf +/usr/local/apache/conf/httpd.conf.default +/usr/local/apache/conf/modsec.conf +/usr/local/apache/conf/php.ini +/usr/local/apache/conf/vhosts.conf +/usr/local/apache/conf/vhosts-custom.conf +/usr/local/apache/httpd.conf +/usr/local/apache/logs/access.log +/usr/local/apache/logs/access_log +/usr/local/apache/logs/audit_log +/usr/local/apache/logs/error.log +/usr/local/apache/logs/error_log +/usr/local/apache/logs/lighttpd.error.log +/usr/local/apache/logs/lighttpd.log +/usr/local/apache/logs/mod_jk.log +/usr/local/apps/apache22/conf/httpd.conf +/usr/local/apps/apache2/conf/httpd.conf +/usr/local/apps/apache/conf/httpd.conf +/usr/local/cpanel/logs +/usr/local/cpanel/logs/access_log +/usr/local/cpanel/logs/error_log +/usr/local/cpanel/logs/license_log +/usr/local/cpanel/logs/login_log +/usr/local/cpanel/logs/stats_log +/usr/local/etc/apache22/conf/httpd.conf +/usr/local/etc/apache22/httpd.conf +/usr/local/etc/apache2/conf/httpd.conf +/usr/local/etc/apache2/httpd.conf +/usr/local/etc/apache2/vhosts.conf +/usr/local/etc/apache/conf/httpd.conf +/usr/local/etc/apache/httpd.conf +/usr/local/etc/apache/vhosts.conf +/usr/local/etc/httpd/conf +/usr/local/etc/httpd/conf/httpd.conf +/usr/local/etc/lighttpd.conf +/usr/local/etc/lighttpd.conf.new +/usr/local/etc/nginx/nginx.conf +/usr/local/etc/php.ini +/usr/local/etc/pure-ftpd.conf +/usr/local/etc/pureftpd.pdb +/usr/local/etc/smb.conf +/usr/local/etc/webmin/miniserv.conf +/usr/local/etc/webmin/miniserv.users +/usr/local/httpd/conf/httpd.conf +/usr/local/jakarta/dist/tomcat/conf/context.xml +/usr/local/jakarta/dist/tomcat/conf/jakarta.conf +/usr/local/jakarta/dist/tomcat/conf/logging.properties +/usr/local/jakarta/dist/tomcat/conf/server.xml +/usr/local/jakarta/dist/tomcat/conf/workers.properties +/usr/local/jakarta/dist/tomcat/logs/mod_jk.log +/usr/local/jakarta/tomcat/conf/context.xml +/usr/local/jakarta/tomcat/conf/jakarta.conf +/usr/local/jakarta/tomcat/conf/logging.properties +/usr/local/jakarta/tomcat/conf/server.xml +/usr/local/jakarta/tomcat/conf/workers.properties +/usr/local/jakarta/tomcat/logs/catalina.err +/usr/local/jakarta/tomcat/logs/catalina.out +/usr/local/jakarta/tomcat/logs/mod_jk.log +/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml +/usr/local/[JBOSS]/server/default/conf/jboss-service.xml +/usr/local/[JBOSS]/server/default/conf/jndi.properties +/usr/local/[JBOSS]/server/default/conf/log4j.xml +/usr/local/[JBOSS]/server/default/conf/login-config.xml +/usr/local/[JBOSS]/server/default/conf/server.log.properties +/usr/local/[JBOSS]/server/default/conf/standardjaws.xml +/usr/local/[JBOSS]/server/default/conf/standardjboss.xml +/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml +/usr/local/[JBOSS]/server/default/log/boot.log +/usr/local/[JBOSS]/server/default/log/server.log +/usr/local/lib/php.ini +/usr/local/lighttpd/conf/lighttpd.conf +/usr/local/lighttpd/log/access.log +/usr/local/lighttpd/log/lighttpd.error.log +/usr/local/logs/access.log +/usr/local/logs/samba.log +/usr/local/lsws/conf/httpd_conf.xml +/usr/local/lsws/logs/error.log +/usr/local/mysql/data/{HOST}.err +/usr/local/mysql/data/mysql-bin.index +/usr/local/mysql/data/mysql-bin.log +/usr/local/mysql/data/mysqlderror.log +/usr/local/mysql/data/mysql.err +/usr/local/mysql/data/mysql.log +/usr/local/mysql/data/mysql-slow.log +/usr/local/nginx/conf/nginx.conf +/usr/local/pgsql/bin/pg_passwd +/usr/local/pgsql/data/passwd +/usr/local/pgsql/data/pg_hba.conf +/usr/local/pgsql/data/pg_log +/usr/local/pgsql/data/postgresql.conf +/usr/local/pgsql/data/postgresql.log +/usr/local/php4/apache2.conf +/usr/local/php4/apache2.conf.php +/usr/local/php4/apache.conf +/usr/local/php4/apache.conf.php +/usr/local/php4/httpd.conf +/usr/local/php4/httpd.conf.php +/usr/local/php4/lib/php.ini +/usr/local/php5/apache2.conf +/usr/local/php5/apache2.conf.php +/usr/local/php5/apache.conf +/usr/local/php5/apache.conf.php +/usr/local/php5/httpd.conf +/usr/local/php5/httpd.conf.php +/usr/local/php5/lib/php.ini +/usr/local/php/apache2.conf +/usr/local/php/apache2.conf.php +/usr/local/php/apache.conf +/usr/local/php/apache.conf.php +/usr/local/php/httpd.conf +/usr/local/php/httpd.conf.php +/usr/local/php/lib/php.ini +/usr/local/psa/admin/conf/php.ini +/usr/local/psa/admin/conf/site_isolation_settings.ini +/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php +/usr/local/psa/admin/logs/httpsd_access_log +/usr/local/psa/admin/logs/panel.log +/usr/local/pureftpd/etc/pure-ftpd.conf +/usr/local/pureftpd/etc/pureftpd.pdb +/usr/local/pureftpd/sbin/pure-config.pl +/usr/local/samba/lib/log.user +/usr/local/samba/lib/smb.conf.user +/usr/local/sb/config +/usr/local/Zend/etc/php.ini +/usr/local/zeus/web/global.cfg +/usr/local/zeus/web/log/errors +/usr/pkg/etc/httpd/httpd.conf +/usr/pkg/etc/httpd/httpd-default.conf +/usr/pkg/etc/httpd/httpd-vhosts.conf +/usr/pkgsrc/net/pureftpd/ +/usr/pkgsrc/net/pureftpd/pure-ftpd.conf +/usr/pkgsrc/net/pureftpd/pureftpd.passwd +/usr/pkgsrc/net/pureftpd/pureftpd.pdb +/usr/ports/contrib/pure-ftpd/ +/usr/ports/contrib/pure-ftpd/pure-ftpd.conf +/usr/ports/contrib/pure-ftpd/pureftpd.passwd +/usr/ports/contrib/pure-ftpd/pureftpd.pdb +/usr/ports/ftp/pure-ftpd/ +/usr/ports/ftp/pure-ftpd/pure-ftpd.conf +/usr/ports/ftp/pure-ftpd/pureftpd.passwd +/usr/ports/ftp/pure-ftpd/pureftpd.pdb +/usr/ports/net/pure-ftpd/ +/usr/ports/net/pure-ftpd/pure-ftpd.conf +/usr/ports/net/pure-ftpd/pureftpd.passwd +/usr/ports/net/pure-ftpd/pureftpd.pdb +/usr/sbin/mudlogd +/usr/sbin/mudpasswd +/usr/sbin/pure-config.pl +/usr/share/adduser/adduser.conf +/usr/share/logs/catalina.err +/usr/share/logs/catalina.out +/usr/share/squirrelmail/config/config.php +/usr/share/squirrelmail/plugins/squirrel_logger/setup.php +/usr/share/tomcat6/conf/context.xml +/usr/share/tomcat6/conf/logging.properties +/usr/share/tomcat6/conf/server.xml +/usr/share/tomcat6/conf/workers.properties +/usr/share/tomcat6/logs/catalina.err +/usr/share/tomcat6/logs/catalina.out +/usr/share/tomcat/logs/catalina.err +/usr/share/tomcat/logs/catalina.out +/usr/spool/lp/log +/usr/spool/mqueue/syslog +/var/adm/acct/sum/loginlog +/var/adm/aculog +/var/adm/aculogs +/var/adm/crash/unix +/var/adm/crash/vmcore +/var/adm/cron/log +/var/adm/dtmp +/var/adm/lastlog/username +/var/adm/log/asppp.log +/var/adm/loginlog +/var/adm/log/xferlog +/var/adm/lp/lpd-errs +/var/adm/messages +/var/adm/pacct +/var/adm/qacct +/var/adm/ras/bootlog +/var/adm/ras/errlog +/var/adm/sulog +/var/adm/SYSLOG +/var/adm/utmp +/var/adm/utmpx +/var/adm/vold.log +/var/adm/wtmp +/var/adm/wtmpx +/var/adm/X0msgs +/var/apache/conf/httpd.conf +/var/cpanel/cpanel.config +/var/cpanel/tomcat.options +/var/cron/log +/var/data/mysql-bin.index +/var/lib/mysql/my.cnf +/var/lib/pgsql/data/postgresql.conf +/var/lib/squirrelmail/prefs/squirrelmail.log +/var/lighttpd.log +/var/local/www/conf/php.ini +/var/log/access.log +/var/log/access_log +/var/log/apache2/access.log +/var/log/apache2/access_log +/var/log/apache2/error.log +/var/log/apache2/error_log +/var/log/apache2/squirrelmail.err.log +/var/log/apache2/squirrelmail.log +/var/log/apache/access.log +/var/log/apache/access_log +/var/log/apache/error.log +/var/log/apache/error_log +/var/log/auth.log +/var/log/authlog +/var/log/boot.log +/var/log/cron/var/log/postgres.log +/var/log/daemon.log +/var/log/daemon.log.1 +/var/log/data/mysql-bin.index +/var/log/dmessage +/var/log/error.log +/var/log/error_log +/var/log/exim/mainlog +/var/log/exim_mainlog +/var/log/exim/paniclog +/var/log/exim_paniclog +/var/log/exim/rejectlog +/var/log/exim_rejectlog +/var/log/ftplog +/var/log/ftp-proxy +/var/log/ftp-proxy/ftp-proxy.log +/var/log/httpd-access.log +/var/log/httpd/access.log +/var/log/httpd/access_log +/var/log/httpd/error.log +/var/log/httpd/error_log +/var/log/ipfw +/var/log/ipfw/ipfw.log +/var/log/ipfw.log +/var/log/ipfw.today +/var/log/kern.log +/var/log/kern.log.1 +/var/log/lighttpd/ +/var/log/lighttpd.access.log +/var/log/lighttpd/access.log +/var/log/lighttpd/access.www.log +/var/log/lighttpd/{DOMAIN}/access.log +/var/log/lighttpd/{DOMAIN}/error.log +/var/log/lighttpd.error.log +/var/log/lighttpd/error.log +/var/log/lighttpd/error.www.log +/var/log/log.smb +/var/log/mail.err +/var/log/mail.info +/var/log/mail.log +/var/log/maillog +/var/log/mail.warn +/var/log/messages +/var/log/messages.1 +/var/log/muddleftpd +/var/log/muddleftpd.conf +/var/log/mysql-bin.index +/var/log/mysql/data/mysql-bin.index +/var/log/mysqlderror.log +/var/log/mysql.err +/var/log/mysql.log +/var/log/mysql/mysql-bin.index +/var/log/mysql/mysql-bin.log +/var/log/mysql/mysql.log +/var/log/mysql/mysql-slow.log +/var/log/news.all +/var/log/news/news.all +/var/log/news/news.crit +/var/log/news/news.err +/var/log/news/news.notice +/var/log/news/suck.err +/var/log/news/suck.notice +/var/log/nginx.access_log +/var/log/nginx/access.log +/var/log/nginx/access_log +/var/log/nginx.error_log +/var/log/nginx/error.log +/var/log/nginx/error_log +/var/log/pgsql8.log +/var/log/pgsql_log +/var/log/pgsql/pgsql.log +/var/log/pm-powersave.log +/var/log/POPlog +/var/log/postgres/pg_backup.log +/var/log/postgres/postgres.log +/var/log/postgresql.log +/var/log/postgresql/main.log +/var/log/postgresql/postgres.log +/var/log/postgresql/postgresql-8.1-main.log +/var/log/postgresql/postgresql-8.3-main.log +/var/log/postgresql/postgresql-8.4-main.log +/var/log/postgresql/postgresql-9.0-main.log +/var/log/postgresql/postgresql-9.1-main.log +/var/log/postgresql/postgresql.log +/var/log/proftpd +/var/log/proftpd.access_log +/var/log/proftpd.xferlog +/var/log/proftpd/xferlog.legacy +/var/log/pureftpd.log +/var/log/pure-ftpd/pure-ftpd.log +/var/logs/access.log +/var/log/samba.log +/var/log/samba.log1 +/var/log/samba.log2 +/var/log/samba/log.nmbd +/var/log/samba/log.smbd +/var/log/squirrelmail.log +/var/log/sso/sso.log +/var/log/sw-cp-server/error_log +/var/log/syslog +/var/log/syslog.1 +/var/log/tomcat6/catalina.out +/var/log/ufw.log +/var/log/user.log +/var/log/user.log.1 +/var/log/vmware/hostd-1.log +/var/log/vmware/hostd.log +/var/log/vsftpd.log +/var/log/webmin/miniserv.log +/var/log/xferlog +/var/log/Xorg.0.log +/var/lp/logs/lpNet +/var/lp/logs/lpsched +/var/lp/logs/requests +/var/mail/root +/var/mysql-bin.index +/var/mysql.log +/var/nm2/postgresql.conf +/var/postgresql/db/postgresql.conf +/var/postgresql/log/postgresql.log +/var/saf/_log +/var/saf/port/log +/var/spool/cron/crontabs/root +/var/spool/cron/crontabs/root +/var/www/conf +/var/www/conf/httpd.conf +/var/www/html/squirrelmail/config/config.php +/var/www/.lighttpdpassword +/var/www/logs/access.log +/var/www/logs/access_log +/var/www/logs/error.log +/var/www/logs/error_log +/var/www/squirrelmail/config/config.php +/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf +/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf +/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf +/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php +/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php +/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php +/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini +/Volumes/webBackup/opt/apache2/conf/httpd.conf +/Volumes/webBackup/private/etc/httpd/httpd.conf +/Volumes/webBackup/private/etc/httpd/httpd.conf.default +/wamp/bin/apache/apache2.2.21/conf/httpd.conf +/wamp/bin/apache/apache2.2.21/logs/access.log +/wamp/bin/apache/apache2.2.21/logs/error.log +/wamp/bin/apache/apache2.2.21/wampserver.conf +/wamp/bin/apache/apache2.2.22/conf/httpd.conf +/wamp/bin/apache/apache2.2.22/conf/wampserver.conf +/wamp/bin/apache/apache2.2.22/logs/access.log +/wamp/bin/apache/apache2.2.22/logs/error.log +/wamp/bin/apache/apache2.2.22/wampserver.conf +/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index +/wamp/bin/mysql/mysql5.5.16/my.ini +/wamp/bin/mysql/mysql5.5.16/wampserver.conf +/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index +/wamp/bin/mysql/mysql5.5.24/my.ini +/wamp/bin/mysql/mysql5.5.24/wampserver.conf +/wamp/logs/access.log +/wamp/logs/apache_error.log +/wamp/logs/genquery.log +/wamp/logs/mysql.log +/wamp/logs/slowquery.log +/web/conf/php.ini +/WINDOWS/php.ini +/WINDOWSphp.ini +/WINDOWS/system32/logfiles/MSFTPSVC +/WINDOWS/system32/logfiles/MSFTPSVC1 +/WINDOWS/system32/logfiles/MSFTPSVC2 +/WINDOWS/system32/logfiles/SMTPSVC +/WINDOWS/system32/logfiles/SMTPSVC1 +/WINDOWS/system32/logfiles/SMTPSVC2 +/WINDOWS/system32/logfiles/SMTPSVC3 +/WINDOWS/system32/logfiles/SMTPSVC4 +/WINDOWS/system32/logfiles/SMTPSVC5 +/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log +/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log +/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log +/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log +/WINNT/php.ini +/WINNTphp.ini +/WINNT/system32/logfiles/MSFTPSVC +/WINNT/system32/logfiles/MSFTPSVC1 +/WINNT/system32/logfiles/MSFTPSVC2 +/WINNT/system32/logfiles/SMTPSVC +/WINNT/system32/logfiles/SMTPSVC1 +/WINNT/system32/logfiles/SMTPSVC2 +/WINNT/system32/logfiles/SMTPSVC3 +/WINNT/system32/logfiles/SMTPSVC4 +/WINNT/system32/logfiles/SMTPSVC5 +/WINNT/system32/logfiles/W3SVC1/inetsvn1.log +/WINNT/system32/logfiles/W3SVC2/inetsvn1.log +/WINNT/system32/logfiles/W3SVC3/inetsvn1.log +/WINNT/system32/logfiles/W3SVC/inetsvn1.log +/www/apache/conf/httpd.conf +/www/conf/httpd.conf +/www/logs/freebsddiary-access_log +/www/logs/freebsddiary-error.log +/www/logs/proftpd.system.log +/xampp/apache/bin/php.ini +/xamppapachebinphp.ini +/xampp/apache/conf/httpd.conf +/xampp/apache/logs/access.log +/xampp/apache/logs/error.log +/xampp/FileZillaFTP/FileZilla Server.xml +/xampp/htdocs/aca.txt +/xampp/htdocs/admin.php +/xampp/htdocs/leer.txt +/xampp/MercuryMail/mercury.ini +/xampp/mysql/data/{HOST}.err +/xampp/mysql/data/mysql-bin.index +/xampp/mysql/data/mysql.err +/xampp/phpMyAdmin/config.inc.php +/xampp/php/php.ini +/xampp/sendmail/sendmail.ini +/xampp/sendmail/sendmail.log +/xampp/webalizer/webalizer.conf +/proc/self/fd/0 +/proc/self/fd/1 +/proc/self/fd/2 +/proc/self/fd/3 +/proc/self/fd/4 +/proc/self/fd/5 +/proc/self/fd/6 +/proc/self/fd/7 +/proc/self/fd/8 +/proc/self/fd/9 +/proc/self/fd/10 +/proc/self/fd/11 +/proc/self/fd/12 +/proc/self/fd/13 +/proc/self/fd/14 +/proc/self/fd/15 +/proc/self/fd/16 +/proc/self/fd/17 +/proc/self/fd/18 +/proc/self/fd/19 +/proc/self/fd/20 +/proc/self/fd/21 +/proc/self/fd/22 +/proc/self/fd/23 +/proc/self/fd/24 +/proc/self/fd/25 +/proc/self/fd/26 +/proc/self/fd/27 +/proc/self/fd/28 +/proc/self/fd/29 +/proc/self/fd/30 +/proc/self/fd/31 +/proc/self/fd/32 +/proc/self/fd/33 +/proc/self/fd/34 +/proc/self/fd/35 +/proc/self/fd/36 +/proc/self/fd/37 +/proc/self/fd/38 +/proc/self/fd/39 +/proc/self/fd/40 +/proc/self/fd/41 +/proc/self/fd/42 +/proc/self/fd/43 +/proc/self/fd/44 +/proc/self/fd/45 +/proc/self/fd/46 +/proc/self/fd/47 +/proc/self/fd/48 +/proc/self/fd/49 +/proc/self/fd/50 +/proc/self/fd/51 +/proc/self/fd/52 +/proc/self/fd/53 +/proc/self/fd/54 +/proc/self/fd/55 +/proc/self/fd/56 +/proc/self/fd/57 +/proc/self/fd/58 +/proc/self/fd/59 +/proc/self/fd/60 +/proc/self/fd/61 +/proc/self/fd/62 +/proc/self/fd/63 +/proc/self/fd/64 +/proc/self/fd/65 +/proc/self/fd/66 +/proc/self/fd/67 +/proc/self/fd/68 +/proc/self/fd/69 +/proc/self/fd/70 +/proc/self/fd/71 +/proc/self/fd/72 +/proc/self/fd/73 +/proc/self/fd/74 +/proc/self/fd/75 +/proc/self/fd/76 +/proc/self/fd/77 +/proc/self/fd/78 +/proc/self/fd/79 +/proc/self/fd/80 +/proc/self/fd/81 +/proc/self/fd/82 +/proc/self/fd/83 +/proc/self/fd/84 +/proc/self/fd/85 +/proc/self/fd/86 +/proc/self/fd/87 +/proc/self/fd/88 +/proc/self/fd/89 +/proc/self/fd/90 +/proc/self/fd/91 +/proc/self/fd/92 +/proc/self/fd/93 +/proc/self/fd/94 +/proc/self/fd/95 +/proc/self/fd/96 +/proc/self/fd/97 +/proc/self/fd/98 +/proc/self/fd/99 +/proc/self/fd/100 \ No newline at end of file diff --git a/lookups/local_file_inclusion_paths.yml b/lookups/local_file_inclusion_paths.yml new file mode 100644 index 0000000000..445adc1282 --- /dev/null +++ b/lookups/local_file_inclusion_paths.yml @@ -0,0 +1,7 @@ +description: A list of interesting files in a local file inclusion attack +filename: local_file_inclusion_linux.csv +name: local_file_inclusion_paths +default_match: 'false' +match_type: WILDCARD(local_file_inclusion_paths) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/macros/kubernetes_container_controller.yml b/macros/kubernetes_container_controller.yml new file mode 100644 index 0000000000..29793801b8 --- /dev/null +++ b/macros/kubernetes_container_controller.yml @@ -0,0 +1,3 @@ +definition: sourcetype=kube:container:controller +description: customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent. +name: kubernetes_container_controller From 622442cd3a1d12e8fcbaff680a366dad9b844d84 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 10:21:21 +0200 Subject: [PATCH 07/70] new detection --- lookups/local_file_inclusion_paths.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/local_file_inclusion_paths.yml b/lookups/local_file_inclusion_paths.yml index 445adc1282..e08394bf85 100644 --- a/lookups/local_file_inclusion_paths.yml +++ b/lookups/local_file_inclusion_paths.yml @@ -1,5 +1,5 @@ description: A list of interesting files in a local file inclusion attack -filename: local_file_inclusion_linux.csv +filename: local_file_inclusion_paths.csv name: local_file_inclusion_paths default_match: 'false' match_type: WILDCARD(local_file_inclusion_paths) From 9f6ec5febb8b1940bcc6003aa6602b70399c9520 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 11:39:21 +0200 Subject: [PATCH 08/70] new detection --- .../cloud/kubernetes_nginx_ingress_lfi.yml | 5 +- lookups/local_file_inclusion_paths.csv | 2016 ++++++++--------- 2 files changed, 1011 insertions(+), 1010 deletions(-) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 85dd0bf5a6..fe48abd74d 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -8,8 +8,9 @@ datamodel: [] description: This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks. search: '`kubernetes_container_controller` -| rex field=_raw "^(?\S+)\s+-\s+(?\S+)\s+\[(?[^\]]*+)\]\s+\"\s*(?[^\s\"]+)\s+(?\S+)\s+(?\S+)\"\s+(?\S+)\s+(?\S+)\s\"(?[^\"]*+)\"\s\"(?[^\"]*+)\"\s(?\S+)\s(?\S+)\s\[(?[^\]]+)\]\s\[(?[^\]]*+)\]\s(?\S+)\s+(?\S+)\s(?\S+)\s(?\S+)\s+(?[^\s]+)" -| `kubernetes_nginx_ingress_lfi_filter`' + | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT local_file_inclusion_paths + | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown references: diff --git a/lookups/local_file_inclusion_paths.csv b/lookups/local_file_inclusion_paths.csv index b46be5720d..ae121fcf9c 100644 --- a/lookups/local_file_inclusion_paths.csv +++ b/lookups/local_file_inclusion_paths.csv @@ -1,1009 +1,1009 @@ local_file_inclusion_paths -/apache2/logs/access.log -/apache2/logs/error.log -/apache/conf/httpd.conf -/apache/logs/access.log -/apache/logs/error.log -/apache/php/php.ini -/apachephpphp.ini -/bin/php.ini -/boot/grub/grub.cfg -/boot/grub/menu.lst -/etc/adduser.conf -/etc/alias -/etc/apache22/conf/httpd.conf -/etc/apache22/httpd.conf -/etc/apache2/apache2.conf -/etc/apache2/apache.conf -/etc/apache2/conf/httpd.conf -/etc/apache2/default-server.conf -/etc/apache2/envvars -/etc/apache2/httpd2.conf -/etc/apache2/httpd.conf -/etc/apache2/mods-available/autoindex.conf -/etc/apache2/mods-available/deflate.conf -/etc/apache2/mods-available/dir.conf -/etc/apache2/mods-available/mem_cache.conf -/etc/apache2/mods-available/mime.conf -/etc/apache2/mods-available/proxy.conf -/etc/apache2/mods-available/setenvif.conf -/etc/apache2/mods-available/ssl.conf -/etc/apache2/mods-enabled/alias.conf -/etc/apache2/mods-enabled/deflate.conf -/etc/apache2/mods-enabled/dir.conf -/etc/apache2/mods-enabled/mime.conf -/etc/apache2/mods-enabled/negotiation.conf -/etc/apache2/mods-enabled/php5.conf -/etc/apache2/mods-enabled/status.conf -/etc/apache2/ports.conf -/etc/apache2/sites-available/default -/etc/apache2/sites-available/default-ssl -/etc/apache2/sites-enabled/000-default -/etc/apache2/sites-enabled/default -/etc/apache2/ssl-global.conf -/etc/apache/access.conf -/etc/apache/apache.conf -/etc/apache/conf/httpd.conf -/etc/apache/default-server.conf -/etc/apache/httpd.conf -/etc/apt/apt.conf -/etc/avahi/avahi-daemon.conf -/etc/bash.bashrc -/etc/bluetooth/input.conf -/etc/bluetooth/main.conf -/etc/bluetooth/network.conf -/etc/bluetooth/rfcomm.conf -/etc/ca-certificates.conf -/etc/ca-certificates.conf.dpkg-old -/etc/casper.conf -/etc/chkrootkit.conf -/etc/chrootUsers -/etc/clamav/clamd.conf -/etc/clamav/freshclam.conf -/etc/crontab -/etc/crypttab -/etc/cups/acroread.conf -/etc/cups/cupsd.conf -/etc/cups/cupsd.conf.default -/etc/cups/pdftops.conf -/etc/cups/printers.conf -/etc/cvs-cron.conf -/etc/cvs-pserver.conf -/etc/debconf.conf -/etc/debian_version -/etc/default/grub -/etc/deluser.conf -/etc/dhcp3/dhclient.conf -/etc/dhcp3/dhcpd.conf -/etc/dhcp/dhclient.conf -/etc/dns2tcpd.conf -/etc/e2fsck.conf -/etc/esound/esd.conf -/etc/etter.conf -/etc/exports -/etc/fedora-release -/etc/firewall.rules -/etc/foremost.conf -/etc/fstab -/etc/ftpchroot -/etc/ftphosts -/etc/ftpusers -/etc/fuse.conf -/etc/group -/etc/group- -/etc/hdparm.conf -/etc/host.conf -/etc/hostname -/etc/hosts -/etc/hosts.allow -/etc/hosts.deny -/etc/http/conf/httpd.conf -/etc/httpd/apache2.conf -/etc/httpd/apache.conf -/etc/httpd.conf -/etc/httpd/conf -/etc/httpd/conf/apache2.conf -/etc/httpd/conf/apache.conf -/etc/httpd/conf.d -/etc/httpd/conf/httpd.conf -/etc/httpd/extra/httpd-ssl.conf -/etc/httpd/httpd.conf -/etc/httpd/logs/acces.log -/etc/httpd/logs/acces_log -/etc/httpd/logs/access.log -/etc/httpd/logs/access_log -/etc/httpd/logs/error.log -/etc/httpd/logs/error_log -/etc/httpd/mod_php.conf -/etc/httpd/php.ini -/etc/http/httpd.conf -/etc/inetd.conf -/etc/init.d -/etc/inittab -/etc/ipfw.conf -/etc/ipfw.rules -/etc/issue -/etc/issue.net -/etc/kbd/config -/etc/kernel-img.conf -/etc/kernel-pkg.conf -/etc/ldap/ldap.conf -/etc/ld.so.conf -/etc/lighttpd/lighthttpd.conf -/etc/login.defs -/etc/logrotate.conf -/etc/ltrace.conf -/etc/mail/sendmail.conf -/etc/mandrake-release -/etc/manpath.config -/etc/miredo.conf -/etc/miredo/miredo.conf -/etc/miredo/miredo-server.conf -/etc/miredo-server.conf -/etc/modules -/etc/mono/config -/etc/motd -/etc/mtab -/etc/mtools.conf -/etc/muddleftpd.com -/etc/muddleftpd/muddleftpd.conf -/etc/muddleftpd/muddleftpd.passwd -/etc/muddleftpd/mudlog -/etc/muddleftpd/mudlogd.conf -/etc/muddleftpd/passwd -/etc/my.cnf -/etc/mysql/my.cnf -/etc/networks -/etc/nginx/nginx.conf -/etc/openldap/ldap.conf -/etc/os-release -/etc/osxhttpd/osxhttpd.conf -/etc/pam.conf -/etc/passwd -/etc/passwd- -/etc/passwd~ -/etc/password.master -/etc/php4/apache2/php.ini -/etc/php4/apache/php.ini -/etc/php4/cgi/php.ini -/etc/php5/apache2/php.ini -/etc/php5/apache/php.ini -/etc/php5/cgi/php.ini -/etc/php/apache2/php.ini -/etc/php/apache/php.ini -/etc/php/cgi/php.ini -/etc/php.ini -/etc/phpmyadmin/config.inc.php -/etc/php/php4/php.ini -/etc/php/php.ini -/etc/postgresql/pg_hba.conf -/etc/postgresql/postgresql.conf -/etc/profile -/etc/proftp.conf -/etc/proftpd/modules.conf -/etc/protpd/proftpd.conf -/etc/pulse/client.conf -/etc/pure-ftpd.conf -/etc/pureftpd.passwd -/etc/pureftpd.pdb -/etc/pure-ftpd/pure-ftpd.conf -/etc/pure-ftpd/pure-ftpd.pdb -/etc/pure-ftpd/pureftpd.pdb -/etc/rc.conf -/etc/redhat-release -/etc/resolv.conf -/etc/samba/dhcp.conf -/etc/samba/netlogon -/etc/samba/private/smbpasswd -/etc/samba/samba.conf -/etc/samba/smb.conf -/etc/samba/smb.conf.user -/etc/samba/smbpasswd -/etc/samba/smbusers -/etc/security/access.conf -/etc/security/environ -/etc/security/failedlogin -/etc/security/group -/etc/security/group.conf -/etc/security/lastlog -/etc/security/limits -/etc/security/limits.conf -/etc/security/namespace.conf -/etc/security/opasswd -/etc/security/pam_env.conf -/etc/security/passwd -/etc/security/passwd -/etc/security/sepermit.conf -/etc/security/time.conf -/etc/security/user -/etc/sensors3.conf -/etc/sensors.conf -/etc/shadow -/etc/shadow- -/etc/shadow~ -/etc/slackware-release -/etc/smb.conf -/etc/smbpasswd -/etc/smi.conf -/etc/squirrelmail/apache.conf -/etc/squirrelmail/config/config.php -/etc/squirrelmail/config_default.php -/etc/squirrelmail/config_local.php -/etc/squirrelmail/config.php -/etc/squirrelmail/default_pref -/etc/squirrelmail/filters_setup.php -/etc/squirrelmail/index.php -/etc/squirrelmail/sqspell_config.php -/etc/ssh/sshd_config -/etc/sso/sso_config.ini -/etc/stunnel/stunnel.conf -/etc/sudoers -/etc/SUSE-release -/etc/sysconfig/network-scripts/ifcfg-eth0 -/etc/sysctl.conf -/etc/syslog.conf -/etc/timezone -/etc/tinyproxy/tinyproxy.conf -/etc/tor/tor-tsocks.conf -/etc/tsocks.conf -/etc/updatedb.conf -/etc/updatedb.conf.BeforeVMwareToolsInstall -/etc/utmp -/etc/vhcs2/proftpd/proftpd.conf -/etc/vmware-tools/config -/etc/vmware-tools/tpvmlp.conf -/etc/vmware-tools/vmware-tools-libraries.conf -/etc/vsftpd.chroot_list -/etc/vsftpd.conf -/etc/vsftpd/vsftpd.conf -/etc/webmin/miniserv.conf -/etc/webmin/miniserv.users -/etc/wicd/dhclient.conf.template.default -/etc/wicd/manager-settings.conf -/etc/wicd/wired-settings.conf -/etc/wicd/wireless-settings.conf -/etc/wu-ftpd/ftpaccess -/etc/wu-ftpd/ftphosts -/etc/wu-ftpd/ftpusers -/etc/X11/xorg.conf -/etc/X11/xorg.conf.BeforeVMwareToolsInstall -/etc/X11/xorg.conf.orig -/etc/X11/xorg.conf-vesa -/etc/X11/xorg.conf-vmware -/home2/bin/stable/apache/php.ini -/home2binstableapachephp.ini -/home/bin/stable/apache/php.ini -/homebinstableapachephp.ini -/home/postgres/data/pg_hba.conf -/home/postgres/data/pg_ident.conf -/home/postgres/data/PG_VERSION -/home/postgres/data/postgresql.conf -/home/user/lighttpd/lighttpd.conf -/http/httpd.conf -/[JBOSS]/server/default/conf/jboss-minimal.xml -/[JBOSS]/server/default/conf/jboss-service.xml -/[JBOSS]/server/default/conf/jndi.properties -/[JBOSS]/server/default/conf/log4j.xml -/[JBOSS]/server/default/conf/login-config.xml -/[JBOSS]/server/default/conf/server.log.properties -/[JBOSS]/server/default/conf/standardjaws.xml -/[JBOSS]/server/default/conf/standardjboss.xml -/[JBOSS]/server/default/deploy/jboss-logging.xml -/[JBOSS]/server/default/log/boot.log -/[JBOSS]/server/default/log/server.log -/Library/WebServer/Documents/default.htm -/Library/WebServer/Documents/default.html -/Library/WebServer/Documents/default.php -/Library/WebServer/Documents/.htaccess -/Library/WebServer/Documents/index.htm -/Library/WebServer/Documents/index.html -/Library/WebServer/Documents/index.php -/logs/access.log -/logs/access_log -/logs/error.log -/logs/error_log -/logs/pure-ftpd.log -/logs/security_debug_log -/logs/security_log -/mysql/bin/my.ini -/MySQL/data/{HOST}.err -/MySQL/data/mysql-bin.index -/MySQL/data/mysql-bin.log -/MySQL/data/mysql.err -/MySQL/data/mysql.log -/MySQL/my.cnf -/MySQL/my.ini -/NetServer/bin/stable/apache/php.ini -/NetServerbinstableapachephp.ini -/opt/apache22/conf/httpd.conf -/opt/apache2/apache2.conf -/opt/apache2/apache.conf -/opt/apache2/conf/apache2.conf -/opt/apache2/conf/apache.conf -/opt/apache2/conf/httpd.conf -/opt/apache/apache2.conf -/opt/apache/apache.conf -/opt/apache/conf/apache2.conf -/opt/apache/conf/apache.conf -/opt/apache/conf/httpd.conf -/opt/httpd/apache2.conf -/opt/httpd/apache.conf -/opt/httpd/conf/apache2.conf -/opt/httpd/conf/apache.conf -/opt/[JBOSS]/server/default/conf/jboss-minimal.xml -/opt/[JBOSS]/server/default/conf/jboss-service.xml -/opt/[JBOSS]/server/default/conf/jndi.properties -/opt/[JBOSS]/server/default/conf/log4j.xml -/opt/[JBOSS]/server/default/conf/login-config.xml -/opt/[JBOSS]/server/default/conf/server.log.properties -/opt/[JBOSS]/server/default/conf/standardjaws.xml -/opt/[JBOSS]/server/default/conf/standardjboss.xml -/opt/[JBOSS]/server/default/deploy/jboss-logging.xml -/opt/[JBOSS]/server/default/log/boot.log -/opt/[JBOSS]/server/default/log/server.log -/opt/lampp/etc/httpd.conf -/opt/lampp/logs/access.log -/opt/lampp/logs/access_log -/opt/lampp/logs/error.log -/opt/lampp/logs/error_log -/opt/lsws/conf/httpd_conf.xml -/opt/lsws/logs/access.log -/opt/lsws/logs/error.log -/opt/tomcat/logs/catalina.err -/opt/tomcat/logs/catalina.out -/opt/xampp/etc/php.ini -/opt/xampp/logs/access.log -/opt/xampp/logs/access_log -/opt/xampp/logs/error.log -/opt/xampp/logs/error_log -/private/etc/httpd/apache2.conf -/private/etc/httpd/apache.conf -/private/etc/httpd/httpd.conf -/private/etc/httpd/httpd.conf.default -/private/etc/squirrelmail/config/config.php -/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml -/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml -/private/tmp/[JBOSS]/server/default/conf/jndi.properties -/private/tmp/[JBOSS]/server/default/conf/log4j.xml -/private/tmp/[JBOSS]/server/default/conf/login-config.xml -/private/tmp/[JBOSS]/server/default/conf/server.log.properties -/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml -/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml -/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml -/private/tmp/[JBOSS]/server/default/log/boot.log -/private/tmp/[JBOSS]/server/default/log/server.log -/proc/cpuinfo -/proc/devices -/proc/meminfo -/proc/net/tcp -/proc/net/udp -/proc/self/cmdline -/proc/self/environ -/proc/self/mounts -/proc/self/stat -/proc/self/status -/proc/version -/Program Files/Apache Group/Apache2/conf/apache2.conf -/Program Files/Apache Group/Apache2/conf/apache.conf -/Program Files/Apache Group/Apache2/conf/httpd.conf -/Program FilesApache GroupApache2confhttpd.conf -/Program Files/Apache Group/Apache/apache2.conf -/Program Files/Apache Group/Apache/apache.conf -/Program Files/Apache Group/Apache/conf/apache2.conf -/Program Files/Apache Group/Apache/conf/apache.conf -/Program Files/Apache Group/Apache/conf/httpd.conf -/Program FilesApache GroupApacheconfhttpd.conf -/Program Files/Apache Group/Apache/logs/access.log -/Program FilesApache GroupApachelogsaccess.log -/Program Files/Apache Group/Apache/logs/error.log -/Program FilesApache GroupApachelogserror.log -/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml -/Program Files/[JBOSS]/server/default/conf/jboss-service.xml -/Program Files/[JBOSS]/server/default/conf/jndi.properties -/Program Files/[JBOSS]/server/default/conf/log4j.xml -/Program Files/[JBOSS]/server/default/conf/login-config.xml -/Program Files/[JBOSS]/server/default/conf/server.log.properties -/Program Files/[JBOSS]/server/default/conf/standardjaws.xml -/Program Files/[JBOSS]/server/default/conf/standardjboss.xml -/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml -/Program Files/[JBOSS]/server/default/log/boot.log -/Program Files/[JBOSS]/server/default/log/server.log -/Program Files/MySQL/data/{HOST}.err -/Program Files/MySQL/data/mysql-bin.index -/Program Files/MySQL/data/mysql-bin.log -/Program Files/MySQL/data/mysql.err -/Program Files/MySQL/data/mysql.log -/Program Files/MySQL/my.cnf -/Program Files/MySQL/my.ini -/Program Files/Vidalia Bundle/Polipo/polipo.conf -/Program Files/xampp/apache/conf/apache2.conf -/Program Files/xampp/apache/conf/apache.conf -/Program Files/xampp/apache/conf/httpd.conf -/Program Filesxamppapacheconfhttpd.conf -/root/.bash_config -/root/.bash_history -/root/.bash_logout -/root/.bashrc -/root/.ksh_history -/root/.Xauthority -/srv/www/htdos/squirrelmail/config/config.php -/tmp/access.log -/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml -/tmp/[JBOSS]/server/default/conf/jboss-service.xml -/tmp/[JBOSS]/server/default/conf/jndi.properties -/tmp/[JBOSS]/server/default/conf/log4j.xml -/tmp/[JBOSS]/server/default/conf/login-config.xml -/tmp/[JBOSS]/server/default/conf/server.log.properties -/tmp/[JBOSS]/server/default/conf/standardjaws.xml -/tmp/[JBOSS]/server/default/conf/standardjboss.xml -/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml -/tmp/[JBOSS]/server/default/log/boot.log -/tmp/[JBOSS]/server/default/log/server.log -/usr/apache2/conf/httpd.conf -/usr/apache/conf/httpd.conf -/usr/etc/pure-ftpd.conf -/usr/home/user/lighttpd/lighttpd.conf -/usr/home/user/var/log/apache.log -/usr/home/user/var/log/lighttpd.error.log -/usr/internet/pgsql/data/pg_hba.conf -/usr/internet/pgsql/data/postmaster.log -/usr/lib/cron/log -/usr/lib/php.ini -/usr/lib/php/php.ini -/usr/lib/security/mkuser.default -/usr/local/apache22/conf/httpd.conf -/usr/local/apache22/httpd.conf -/usr/local/apache2/apache2.conf -/usr/local/apache2/apache.conf -/usr/local/apache2/conf/apache2.conf -/usr/local/apache2/conf/apache.conf -/usr/local/apache2/conf/extra/httpd-ssl.conf -/usr/local/apache2/conf/httpd.conf -/usr/local/apache2/conf/modsec.conf -/usr/local/apache2/conf/ssl.conf -/usr/local/apache2/conf/vhosts.conf -/usr/local/apache2/conf/vhosts-custom.conf -/usr/local/apache2/httpd.conf -/usr/local/apache2/logs/access.log -/usr/local/apache2/logs/access_log -/usr/local/apache2/logs/audit_log -/usr/local/apache2/logs/error.log -/usr/local/apache2/logs/error_log -/usr/local/apache2/logs/lighttpd.error.log -/usr/local/apache2/logs/lighttpd.log -/usr/local/apache/apache2.conf -/usr/local/apache/apache.conf -/usr/local/apache/conf/access.conf -/usr/local/apache/conf/apache2.conf -/usr/local/apache/conf/apache.conf -/usr/local/apache/conf/httpd.conf -/usr/local/apache/conf/httpd.conf.default -/usr/local/apache/conf/modsec.conf -/usr/local/apache/conf/php.ini -/usr/local/apache/conf/vhosts.conf -/usr/local/apache/conf/vhosts-custom.conf -/usr/local/apache/httpd.conf -/usr/local/apache/logs/access.log -/usr/local/apache/logs/access_log -/usr/local/apache/logs/audit_log -/usr/local/apache/logs/error.log -/usr/local/apache/logs/error_log -/usr/local/apache/logs/lighttpd.error.log -/usr/local/apache/logs/lighttpd.log -/usr/local/apache/logs/mod_jk.log -/usr/local/apps/apache22/conf/httpd.conf -/usr/local/apps/apache2/conf/httpd.conf -/usr/local/apps/apache/conf/httpd.conf -/usr/local/cpanel/logs -/usr/local/cpanel/logs/access_log -/usr/local/cpanel/logs/error_log -/usr/local/cpanel/logs/license_log -/usr/local/cpanel/logs/login_log -/usr/local/cpanel/logs/stats_log -/usr/local/etc/apache22/conf/httpd.conf -/usr/local/etc/apache22/httpd.conf -/usr/local/etc/apache2/conf/httpd.conf -/usr/local/etc/apache2/httpd.conf -/usr/local/etc/apache2/vhosts.conf -/usr/local/etc/apache/conf/httpd.conf -/usr/local/etc/apache/httpd.conf -/usr/local/etc/apache/vhosts.conf -/usr/local/etc/httpd/conf -/usr/local/etc/httpd/conf/httpd.conf -/usr/local/etc/lighttpd.conf -/usr/local/etc/lighttpd.conf.new -/usr/local/etc/nginx/nginx.conf -/usr/local/etc/php.ini -/usr/local/etc/pure-ftpd.conf -/usr/local/etc/pureftpd.pdb -/usr/local/etc/smb.conf -/usr/local/etc/webmin/miniserv.conf -/usr/local/etc/webmin/miniserv.users -/usr/local/httpd/conf/httpd.conf -/usr/local/jakarta/dist/tomcat/conf/context.xml -/usr/local/jakarta/dist/tomcat/conf/jakarta.conf -/usr/local/jakarta/dist/tomcat/conf/logging.properties -/usr/local/jakarta/dist/tomcat/conf/server.xml -/usr/local/jakarta/dist/tomcat/conf/workers.properties -/usr/local/jakarta/dist/tomcat/logs/mod_jk.log -/usr/local/jakarta/tomcat/conf/context.xml -/usr/local/jakarta/tomcat/conf/jakarta.conf -/usr/local/jakarta/tomcat/conf/logging.properties -/usr/local/jakarta/tomcat/conf/server.xml -/usr/local/jakarta/tomcat/conf/workers.properties -/usr/local/jakarta/tomcat/logs/catalina.err -/usr/local/jakarta/tomcat/logs/catalina.out -/usr/local/jakarta/tomcat/logs/mod_jk.log -/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml -/usr/local/[JBOSS]/server/default/conf/jboss-service.xml -/usr/local/[JBOSS]/server/default/conf/jndi.properties -/usr/local/[JBOSS]/server/default/conf/log4j.xml -/usr/local/[JBOSS]/server/default/conf/login-config.xml -/usr/local/[JBOSS]/server/default/conf/server.log.properties -/usr/local/[JBOSS]/server/default/conf/standardjaws.xml -/usr/local/[JBOSS]/server/default/conf/standardjboss.xml -/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml -/usr/local/[JBOSS]/server/default/log/boot.log -/usr/local/[JBOSS]/server/default/log/server.log -/usr/local/lib/php.ini -/usr/local/lighttpd/conf/lighttpd.conf -/usr/local/lighttpd/log/access.log -/usr/local/lighttpd/log/lighttpd.error.log -/usr/local/logs/access.log -/usr/local/logs/samba.log -/usr/local/lsws/conf/httpd_conf.xml -/usr/local/lsws/logs/error.log -/usr/local/mysql/data/{HOST}.err -/usr/local/mysql/data/mysql-bin.index -/usr/local/mysql/data/mysql-bin.log -/usr/local/mysql/data/mysqlderror.log -/usr/local/mysql/data/mysql.err -/usr/local/mysql/data/mysql.log -/usr/local/mysql/data/mysql-slow.log -/usr/local/nginx/conf/nginx.conf -/usr/local/pgsql/bin/pg_passwd -/usr/local/pgsql/data/passwd -/usr/local/pgsql/data/pg_hba.conf -/usr/local/pgsql/data/pg_log -/usr/local/pgsql/data/postgresql.conf -/usr/local/pgsql/data/postgresql.log -/usr/local/php4/apache2.conf -/usr/local/php4/apache2.conf.php -/usr/local/php4/apache.conf -/usr/local/php4/apache.conf.php -/usr/local/php4/httpd.conf -/usr/local/php4/httpd.conf.php -/usr/local/php4/lib/php.ini -/usr/local/php5/apache2.conf -/usr/local/php5/apache2.conf.php -/usr/local/php5/apache.conf -/usr/local/php5/apache.conf.php -/usr/local/php5/httpd.conf -/usr/local/php5/httpd.conf.php -/usr/local/php5/lib/php.ini -/usr/local/php/apache2.conf -/usr/local/php/apache2.conf.php -/usr/local/php/apache.conf -/usr/local/php/apache.conf.php -/usr/local/php/httpd.conf -/usr/local/php/httpd.conf.php -/usr/local/php/lib/php.ini -/usr/local/psa/admin/conf/php.ini -/usr/local/psa/admin/conf/site_isolation_settings.ini -/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php -/usr/local/psa/admin/logs/httpsd_access_log -/usr/local/psa/admin/logs/panel.log -/usr/local/pureftpd/etc/pure-ftpd.conf -/usr/local/pureftpd/etc/pureftpd.pdb -/usr/local/pureftpd/sbin/pure-config.pl -/usr/local/samba/lib/log.user -/usr/local/samba/lib/smb.conf.user -/usr/local/sb/config -/usr/local/Zend/etc/php.ini -/usr/local/zeus/web/global.cfg -/usr/local/zeus/web/log/errors -/usr/pkg/etc/httpd/httpd.conf -/usr/pkg/etc/httpd/httpd-default.conf -/usr/pkg/etc/httpd/httpd-vhosts.conf -/usr/pkgsrc/net/pureftpd/ -/usr/pkgsrc/net/pureftpd/pure-ftpd.conf -/usr/pkgsrc/net/pureftpd/pureftpd.passwd -/usr/pkgsrc/net/pureftpd/pureftpd.pdb -/usr/ports/contrib/pure-ftpd/ -/usr/ports/contrib/pure-ftpd/pure-ftpd.conf -/usr/ports/contrib/pure-ftpd/pureftpd.passwd -/usr/ports/contrib/pure-ftpd/pureftpd.pdb -/usr/ports/ftp/pure-ftpd/ -/usr/ports/ftp/pure-ftpd/pure-ftpd.conf -/usr/ports/ftp/pure-ftpd/pureftpd.passwd -/usr/ports/ftp/pure-ftpd/pureftpd.pdb -/usr/ports/net/pure-ftpd/ -/usr/ports/net/pure-ftpd/pure-ftpd.conf -/usr/ports/net/pure-ftpd/pureftpd.passwd -/usr/ports/net/pure-ftpd/pureftpd.pdb -/usr/sbin/mudlogd -/usr/sbin/mudpasswd -/usr/sbin/pure-config.pl -/usr/share/adduser/adduser.conf -/usr/share/logs/catalina.err -/usr/share/logs/catalina.out -/usr/share/squirrelmail/config/config.php -/usr/share/squirrelmail/plugins/squirrel_logger/setup.php -/usr/share/tomcat6/conf/context.xml -/usr/share/tomcat6/conf/logging.properties -/usr/share/tomcat6/conf/server.xml -/usr/share/tomcat6/conf/workers.properties -/usr/share/tomcat6/logs/catalina.err -/usr/share/tomcat6/logs/catalina.out -/usr/share/tomcat/logs/catalina.err -/usr/share/tomcat/logs/catalina.out -/usr/spool/lp/log -/usr/spool/mqueue/syslog -/var/adm/acct/sum/loginlog -/var/adm/aculog -/var/adm/aculogs -/var/adm/crash/unix -/var/adm/crash/vmcore -/var/adm/cron/log -/var/adm/dtmp -/var/adm/lastlog/username -/var/adm/log/asppp.log -/var/adm/loginlog -/var/adm/log/xferlog -/var/adm/lp/lpd-errs -/var/adm/messages -/var/adm/pacct -/var/adm/qacct -/var/adm/ras/bootlog -/var/adm/ras/errlog -/var/adm/sulog -/var/adm/SYSLOG -/var/adm/utmp -/var/adm/utmpx -/var/adm/vold.log -/var/adm/wtmp -/var/adm/wtmpx -/var/adm/X0msgs -/var/apache/conf/httpd.conf -/var/cpanel/cpanel.config -/var/cpanel/tomcat.options -/var/cron/log -/var/data/mysql-bin.index -/var/lib/mysql/my.cnf -/var/lib/pgsql/data/postgresql.conf -/var/lib/squirrelmail/prefs/squirrelmail.log -/var/lighttpd.log -/var/local/www/conf/php.ini -/var/log/access.log -/var/log/access_log -/var/log/apache2/access.log -/var/log/apache2/access_log -/var/log/apache2/error.log -/var/log/apache2/error_log -/var/log/apache2/squirrelmail.err.log -/var/log/apache2/squirrelmail.log -/var/log/apache/access.log -/var/log/apache/access_log -/var/log/apache/error.log -/var/log/apache/error_log -/var/log/auth.log -/var/log/authlog -/var/log/boot.log -/var/log/cron/var/log/postgres.log -/var/log/daemon.log -/var/log/daemon.log.1 -/var/log/data/mysql-bin.index -/var/log/dmessage -/var/log/error.log -/var/log/error_log -/var/log/exim/mainlog -/var/log/exim_mainlog -/var/log/exim/paniclog -/var/log/exim_paniclog -/var/log/exim/rejectlog -/var/log/exim_rejectlog -/var/log/ftplog -/var/log/ftp-proxy -/var/log/ftp-proxy/ftp-proxy.log -/var/log/httpd-access.log -/var/log/httpd/access.log -/var/log/httpd/access_log -/var/log/httpd/error.log -/var/log/httpd/error_log -/var/log/ipfw -/var/log/ipfw/ipfw.log -/var/log/ipfw.log -/var/log/ipfw.today -/var/log/kern.log -/var/log/kern.log.1 -/var/log/lighttpd/ -/var/log/lighttpd.access.log -/var/log/lighttpd/access.log -/var/log/lighttpd/access.www.log -/var/log/lighttpd/{DOMAIN}/access.log -/var/log/lighttpd/{DOMAIN}/error.log -/var/log/lighttpd.error.log -/var/log/lighttpd/error.log -/var/log/lighttpd/error.www.log -/var/log/log.smb -/var/log/mail.err -/var/log/mail.info -/var/log/mail.log -/var/log/maillog -/var/log/mail.warn -/var/log/messages -/var/log/messages.1 -/var/log/muddleftpd -/var/log/muddleftpd.conf -/var/log/mysql-bin.index -/var/log/mysql/data/mysql-bin.index -/var/log/mysqlderror.log -/var/log/mysql.err -/var/log/mysql.log -/var/log/mysql/mysql-bin.index -/var/log/mysql/mysql-bin.log -/var/log/mysql/mysql.log -/var/log/mysql/mysql-slow.log -/var/log/news.all -/var/log/news/news.all -/var/log/news/news.crit -/var/log/news/news.err -/var/log/news/news.notice -/var/log/news/suck.err -/var/log/news/suck.notice -/var/log/nginx.access_log -/var/log/nginx/access.log -/var/log/nginx/access_log -/var/log/nginx.error_log -/var/log/nginx/error.log -/var/log/nginx/error_log -/var/log/pgsql8.log -/var/log/pgsql_log -/var/log/pgsql/pgsql.log -/var/log/pm-powersave.log -/var/log/POPlog -/var/log/postgres/pg_backup.log -/var/log/postgres/postgres.log -/var/log/postgresql.log -/var/log/postgresql/main.log -/var/log/postgresql/postgres.log -/var/log/postgresql/postgresql-8.1-main.log -/var/log/postgresql/postgresql-8.3-main.log -/var/log/postgresql/postgresql-8.4-main.log -/var/log/postgresql/postgresql-9.0-main.log -/var/log/postgresql/postgresql-9.1-main.log -/var/log/postgresql/postgresql.log -/var/log/proftpd -/var/log/proftpd.access_log -/var/log/proftpd.xferlog -/var/log/proftpd/xferlog.legacy -/var/log/pureftpd.log -/var/log/pure-ftpd/pure-ftpd.log -/var/logs/access.log -/var/log/samba.log -/var/log/samba.log1 -/var/log/samba.log2 -/var/log/samba/log.nmbd -/var/log/samba/log.smbd -/var/log/squirrelmail.log -/var/log/sso/sso.log -/var/log/sw-cp-server/error_log -/var/log/syslog -/var/log/syslog.1 -/var/log/tomcat6/catalina.out -/var/log/ufw.log -/var/log/user.log -/var/log/user.log.1 -/var/log/vmware/hostd-1.log -/var/log/vmware/hostd.log -/var/log/vsftpd.log -/var/log/webmin/miniserv.log -/var/log/xferlog -/var/log/Xorg.0.log -/var/lp/logs/lpNet -/var/lp/logs/lpsched -/var/lp/logs/requests -/var/mail/root -/var/mysql-bin.index -/var/mysql.log -/var/nm2/postgresql.conf -/var/postgresql/db/postgresql.conf -/var/postgresql/log/postgresql.log -/var/saf/_log -/var/saf/port/log -/var/spool/cron/crontabs/root -/var/spool/cron/crontabs/root -/var/www/conf -/var/www/conf/httpd.conf -/var/www/html/squirrelmail/config/config.php -/var/www/.lighttpdpassword -/var/www/logs/access.log -/var/www/logs/access_log -/var/www/logs/error.log -/var/www/logs/error_log -/var/www/squirrelmail/config/config.php -/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf -/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf -/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf -/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php -/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php -/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php -/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini -/Volumes/webBackup/opt/apache2/conf/httpd.conf -/Volumes/webBackup/private/etc/httpd/httpd.conf -/Volumes/webBackup/private/etc/httpd/httpd.conf.default -/wamp/bin/apache/apache2.2.21/conf/httpd.conf -/wamp/bin/apache/apache2.2.21/logs/access.log -/wamp/bin/apache/apache2.2.21/logs/error.log -/wamp/bin/apache/apache2.2.21/wampserver.conf -/wamp/bin/apache/apache2.2.22/conf/httpd.conf -/wamp/bin/apache/apache2.2.22/conf/wampserver.conf -/wamp/bin/apache/apache2.2.22/logs/access.log -/wamp/bin/apache/apache2.2.22/logs/error.log -/wamp/bin/apache/apache2.2.22/wampserver.conf -/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index -/wamp/bin/mysql/mysql5.5.16/my.ini -/wamp/bin/mysql/mysql5.5.16/wampserver.conf -/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index -/wamp/bin/mysql/mysql5.5.24/my.ini -/wamp/bin/mysql/mysql5.5.24/wampserver.conf -/wamp/logs/access.log -/wamp/logs/apache_error.log -/wamp/logs/genquery.log -/wamp/logs/mysql.log -/wamp/logs/slowquery.log -/web/conf/php.ini -/WINDOWS/php.ini -/WINDOWSphp.ini -/WINDOWS/system32/logfiles/MSFTPSVC -/WINDOWS/system32/logfiles/MSFTPSVC1 -/WINDOWS/system32/logfiles/MSFTPSVC2 -/WINDOWS/system32/logfiles/SMTPSVC -/WINDOWS/system32/logfiles/SMTPSVC1 -/WINDOWS/system32/logfiles/SMTPSVC2 -/WINDOWS/system32/logfiles/SMTPSVC3 -/WINDOWS/system32/logfiles/SMTPSVC4 -/WINDOWS/system32/logfiles/SMTPSVC5 -/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log -/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log -/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log -/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log -/WINNT/php.ini -/WINNTphp.ini -/WINNT/system32/logfiles/MSFTPSVC -/WINNT/system32/logfiles/MSFTPSVC1 -/WINNT/system32/logfiles/MSFTPSVC2 -/WINNT/system32/logfiles/SMTPSVC -/WINNT/system32/logfiles/SMTPSVC1 -/WINNT/system32/logfiles/SMTPSVC2 -/WINNT/system32/logfiles/SMTPSVC3 -/WINNT/system32/logfiles/SMTPSVC4 -/WINNT/system32/logfiles/SMTPSVC5 -/WINNT/system32/logfiles/W3SVC1/inetsvn1.log -/WINNT/system32/logfiles/W3SVC2/inetsvn1.log -/WINNT/system32/logfiles/W3SVC3/inetsvn1.log -/WINNT/system32/logfiles/W3SVC/inetsvn1.log -/www/apache/conf/httpd.conf -/www/conf/httpd.conf -/www/logs/freebsddiary-access_log -/www/logs/freebsddiary-error.log -/www/logs/proftpd.system.log -/xampp/apache/bin/php.ini -/xamppapachebinphp.ini -/xampp/apache/conf/httpd.conf -/xampp/apache/logs/access.log -/xampp/apache/logs/error.log -/xampp/FileZillaFTP/FileZilla Server.xml -/xampp/htdocs/aca.txt -/xampp/htdocs/admin.php -/xampp/htdocs/leer.txt -/xampp/MercuryMail/mercury.ini -/xampp/mysql/data/{HOST}.err -/xampp/mysql/data/mysql-bin.index -/xampp/mysql/data/mysql.err -/xampp/phpMyAdmin/config.inc.php -/xampp/php/php.ini -/xampp/sendmail/sendmail.ini -/xampp/sendmail/sendmail.log -/xampp/webalizer/webalizer.conf -/proc/self/fd/0 -/proc/self/fd/1 -/proc/self/fd/2 -/proc/self/fd/3 -/proc/self/fd/4 -/proc/self/fd/5 -/proc/self/fd/6 -/proc/self/fd/7 -/proc/self/fd/8 -/proc/self/fd/9 -/proc/self/fd/10 -/proc/self/fd/11 -/proc/self/fd/12 -/proc/self/fd/13 -/proc/self/fd/14 -/proc/self/fd/15 -/proc/self/fd/16 -/proc/self/fd/17 -/proc/self/fd/18 -/proc/self/fd/19 -/proc/self/fd/20 -/proc/self/fd/21 -/proc/self/fd/22 -/proc/self/fd/23 -/proc/self/fd/24 -/proc/self/fd/25 -/proc/self/fd/26 -/proc/self/fd/27 -/proc/self/fd/28 -/proc/self/fd/29 -/proc/self/fd/30 -/proc/self/fd/31 -/proc/self/fd/32 -/proc/self/fd/33 -/proc/self/fd/34 -/proc/self/fd/35 -/proc/self/fd/36 -/proc/self/fd/37 -/proc/self/fd/38 -/proc/self/fd/39 -/proc/self/fd/40 -/proc/self/fd/41 -/proc/self/fd/42 -/proc/self/fd/43 -/proc/self/fd/44 -/proc/self/fd/45 -/proc/self/fd/46 -/proc/self/fd/47 -/proc/self/fd/48 -/proc/self/fd/49 -/proc/self/fd/50 -/proc/self/fd/51 -/proc/self/fd/52 -/proc/self/fd/53 -/proc/self/fd/54 -/proc/self/fd/55 -/proc/self/fd/56 -/proc/self/fd/57 -/proc/self/fd/58 -/proc/self/fd/59 -/proc/self/fd/60 -/proc/self/fd/61 -/proc/self/fd/62 -/proc/self/fd/63 -/proc/self/fd/64 -/proc/self/fd/65 -/proc/self/fd/66 -/proc/self/fd/67 -/proc/self/fd/68 -/proc/self/fd/69 -/proc/self/fd/70 -/proc/self/fd/71 -/proc/self/fd/72 -/proc/self/fd/73 -/proc/self/fd/74 -/proc/self/fd/75 -/proc/self/fd/76 -/proc/self/fd/77 -/proc/self/fd/78 -/proc/self/fd/79 -/proc/self/fd/80 -/proc/self/fd/81 -/proc/self/fd/82 -/proc/self/fd/83 -/proc/self/fd/84 -/proc/self/fd/85 -/proc/self/fd/86 -/proc/self/fd/87 -/proc/self/fd/88 -/proc/self/fd/89 -/proc/self/fd/90 -/proc/self/fd/91 -/proc/self/fd/92 -/proc/self/fd/93 -/proc/self/fd/94 -/proc/self/fd/95 -/proc/self/fd/96 -/proc/self/fd/97 -/proc/self/fd/98 -/proc/self/fd/99 -/proc/self/fd/100 \ No newline at end of file +*/apache2/logs/access.log* +*/apache2/logs/error.log* +*/apache/conf/httpd.conf* +*/apache/logs/access.log* +*/apache/logs/error.log* +*/apache/php/php.ini* +*/apachephpphp.ini* +*/bin/php.ini* +*/boot/grub/grub.cfg* +*/boot/grub/menu.lst* +*/etc/adduser.conf* +*/etc/alias* +*/etc/apache22/conf/httpd.conf* +*/etc/apache22/httpd.conf* +*/etc/apache2/apache2.conf* +*/etc/apache2/apache.conf* +*/etc/apache2/conf/httpd.conf* +*/etc/apache2/default-server.conf* +*/etc/apache2/envvars* +*/etc/apache2/httpd2.conf* +*/etc/apache2/httpd.conf* +*/etc/apache2/mods-available/autoindex.conf* +*/etc/apache2/mods-available/deflate.conf* +*/etc/apache2/mods-available/dir.conf* +*/etc/apache2/mods-available/mem_cache.conf* +*/etc/apache2/mods-available/mime.conf* +*/etc/apache2/mods-available/proxy.conf* +*/etc/apache2/mods-available/setenvif.conf* +*/etc/apache2/mods-available/ssl.conf* +*/etc/apache2/mods-enabled/alias.conf* +*/etc/apache2/mods-enabled/deflate.conf* +*/etc/apache2/mods-enabled/dir.conf* +*/etc/apache2/mods-enabled/mime.conf* +*/etc/apache2/mods-enabled/negotiation.conf* +*/etc/apache2/mods-enabled/php5.conf* +*/etc/apache2/mods-enabled/status.conf* +*/etc/apache2/ports.conf* +*/etc/apache2/sites-available/default* +*/etc/apache2/sites-available/default-ssl* +*/etc/apache2/sites-enabled/000-default* +*/etc/apache2/sites-enabled/default* +*/etc/apache2/ssl-global.conf* +*/etc/apache/access.conf* +*/etc/apache/apache.conf* +*/etc/apache/conf/httpd.conf* +*/etc/apache/default-server.conf* +*/etc/apache/httpd.conf* +*/etc/apt/apt.conf* +*/etc/avahi/avahi-daemon.conf* +*/etc/bash.bashrc* +*/etc/bluetooth/input.conf* +*/etc/bluetooth/main.conf* +*/etc/bluetooth/network.conf* +*/etc/bluetooth/rfcomm.conf* +*/etc/ca-certificates.conf* +*/etc/ca-certificates.conf.dpkg-old* +*/etc/casper.conf* +*/etc/chkrootkit.conf* +*/etc/chrootUsers* +*/etc/clamav/clamd.conf* +*/etc/clamav/freshclam.conf* +*/etc/crontab* +*/etc/crypttab* +*/etc/cups/acroread.conf* +*/etc/cups/cupsd.conf* +*/etc/cups/cupsd.conf.default* +*/etc/cups/pdftops.conf* +*/etc/cups/printers.conf* +*/etc/cvs-cron.conf* +*/etc/cvs-pserver.conf* +*/etc/debconf.conf* +*/etc/debian_version* +*/etc/default/grub* +*/etc/deluser.conf* +*/etc/dhcp3/dhclient.conf* +*/etc/dhcp3/dhcpd.conf* +*/etc/dhcp/dhclient.conf* +*/etc/dns2tcpd.conf* +*/etc/e2fsck.conf* +*/etc/esound/esd.conf* +*/etc/etter.conf* +*/etc/exports* +*/etc/fedora-release* +*/etc/firewall.rules* +*/etc/foremost.conf* +*/etc/fstab* +*/etc/ftpchroot* +*/etc/ftphosts* +*/etc/ftpusers* +*/etc/fuse.conf* +*/etc/group* +*/etc/group-* +*/etc/hdparm.conf* +*/etc/host.conf* +*/etc/hostname* +*/etc/hosts* +*/etc/hosts.allow* +*/etc/hosts.deny* +*/etc/http/conf/httpd.conf* +*/etc/httpd/apache2.conf* +*/etc/httpd/apache.conf* +*/etc/httpd.conf* +*/etc/httpd/conf* +*/etc/httpd/conf/apache2.conf* +*/etc/httpd/conf/apache.conf* +*/etc/httpd/conf.d* +*/etc/httpd/conf/httpd.conf* +*/etc/httpd/extra/httpd-ssl.conf* +*/etc/httpd/httpd.conf* +*/etc/httpd/logs/acces.log* +*/etc/httpd/logs/acces_log* +*/etc/httpd/logs/access.log* +*/etc/httpd/logs/access_log* +*/etc/httpd/logs/error.log* +*/etc/httpd/logs/error_log* +*/etc/httpd/mod_php.conf* +*/etc/httpd/php.ini* +*/etc/http/httpd.conf* +*/etc/inetd.conf* +*/etc/init.d* +*/etc/inittab* +*/etc/ipfw.conf* +*/etc/ipfw.rules* +*/etc/issue* +*/etc/issue.net* +*/etc/kbd/config* +*/etc/kernel-img.conf* +*/etc/kernel-pkg.conf* +*/etc/ldap/ldap.conf* +*/etc/ld.so.conf* +*/etc/lighttpd/lighthttpd.conf* +*/etc/login.defs* +*/etc/logrotate.conf* +*/etc/ltrace.conf* +*/etc/mail/sendmail.conf* +*/etc/mandrake-release* +*/etc/manpath.config* +*/etc/miredo.conf* +*/etc/miredo/miredo.conf* +*/etc/miredo/miredo-server.conf* +*/etc/miredo-server.conf* +*/etc/modules* +*/etc/mono/config* +*/etc/motd* +*/etc/mtab* +*/etc/mtools.conf* +*/etc/muddleftpd.com* +*/etc/muddleftpd/muddleftpd.conf* +*/etc/muddleftpd/muddleftpd.passwd* +*/etc/muddleftpd/mudlog* +*/etc/muddleftpd/mudlogd.conf* +*/etc/muddleftpd/passwd* +*/etc/my.cnf* +*/etc/mysql/my.cnf* +*/etc/networks* +*/etc/nginx/nginx.conf* +*/etc/openldap/ldap.conf* +*/etc/os-release* +*/etc/osxhttpd/osxhttpd.conf* +*/etc/pam.conf* +*/etc/passwd* +*/etc/passwd-* +*/etc/passwd~* +*/etc/password.master* +*/etc/php4/apache2/php.ini* +*/etc/php4/apache/php.ini* +*/etc/php4/cgi/php.ini* +*/etc/php5/apache2/php.ini* +*/etc/php5/apache/php.ini* +*/etc/php5/cgi/php.ini* +*/etc/php/apache2/php.ini* +*/etc/php/apache/php.ini* +*/etc/php/cgi/php.ini* +*/etc/php.ini* +*/etc/phpmyadmin/config.inc.php* +*/etc/php/php4/php.ini* +*/etc/php/php.ini* +*/etc/postgresql/pg_hba.conf* +*/etc/postgresql/postgresql.conf* +*/etc/profile* +*/etc/proftp.conf* +*/etc/proftpd/modules.conf* +*/etc/protpd/proftpd.conf* +*/etc/pulse/client.conf* +*/etc/pure-ftpd.conf* +*/etc/pureftpd.passwd* +*/etc/pureftpd.pdb* +*/etc/pure-ftpd/pure-ftpd.conf* +*/etc/pure-ftpd/pure-ftpd.pdb* +*/etc/pure-ftpd/pureftpd.pdb* +*/etc/rc.conf* +*/etc/redhat-release* +*/etc/resolv.conf* +*/etc/samba/dhcp.conf* +*/etc/samba/netlogon* +*/etc/samba/private/smbpasswd* +*/etc/samba/samba.conf* +*/etc/samba/smb.conf* +*/etc/samba/smb.conf.user* +*/etc/samba/smbpasswd* +*/etc/samba/smbusers* +*/etc/security/access.conf* +*/etc/security/environ* +*/etc/security/failedlogin* +*/etc/security/group* +*/etc/security/group.conf* +*/etc/security/lastlog* +*/etc/security/limits* +*/etc/security/limits.conf* +*/etc/security/namespace.conf* +*/etc/security/opasswd* +*/etc/security/pam_env.conf* +*/etc/security/passwd* +*/etc/security/passwd* +*/etc/security/sepermit.conf* +*/etc/security/time.conf* +*/etc/security/user* +*/etc/sensors3.conf* +*/etc/sensors.conf* +*/etc/shadow* +*/etc/shadow-* +*/etc/shadow~* +*/etc/slackware-release* +*/etc/smb.conf* +*/etc/smbpasswd* +*/etc/smi.conf* +*/etc/squirrelmail/apache.conf* +*/etc/squirrelmail/config/config.php* +*/etc/squirrelmail/config_default.php* +*/etc/squirrelmail/config_local.php* +*/etc/squirrelmail/config.php* +*/etc/squirrelmail/default_pref* +*/etc/squirrelmail/filters_setup.php* +*/etc/squirrelmail/index.php* +*/etc/squirrelmail/sqspell_config.php* +*/etc/ssh/sshd_config* +*/etc/sso/sso_config.ini* +*/etc/stunnel/stunnel.conf* +*/etc/sudoers* +*/etc/SUSE-release* +*/etc/sysconfig/network-scripts/ifcfg-eth0* +*/etc/sysctl.conf* +*/etc/syslog.conf* +*/etc/timezone* +*/etc/tinyproxy/tinyproxy.conf* +*/etc/tor/tor-tsocks.conf* +*/etc/tsocks.conf* +*/etc/updatedb.conf* +*/etc/updatedb.conf.BeforeVMwareToolsInstall* +*/etc/utmp* +*/etc/vhcs2/proftpd/proftpd.conf* +*/etc/vmware-tools/config* +*/etc/vmware-tools/tpvmlp.conf* +*/etc/vmware-tools/vmware-tools-libraries.conf* +*/etc/vsftpd.chroot_list* +*/etc/vsftpd.conf* +*/etc/vsftpd/vsftpd.conf* +*/etc/webmin/miniserv.conf* +*/etc/webmin/miniserv.users* +*/etc/wicd/dhclient.conf.template.default* +*/etc/wicd/manager-settings.conf* +*/etc/wicd/wired-settings.conf* +*/etc/wicd/wireless-settings.conf* +*/etc/wu-ftpd/ftpaccess* +*/etc/wu-ftpd/ftphosts* +*/etc/wu-ftpd/ftpusers* +*/etc/X11/xorg.conf* +*/etc/X11/xorg.conf.BeforeVMwareToolsInstall* +*/etc/X11/xorg.conf.orig* +*/etc/X11/xorg.conf-vesa* +*/etc/X11/xorg.conf-vmware* +*/home2/bin/stable/apache/php.ini* +*/home2binstableapachephp.ini* +*/home/bin/stable/apache/php.ini* +*/homebinstableapachephp.ini* +*/home/postgres/data/pg_hba.conf* +*/home/postgres/data/pg_ident.conf* +*/home/postgres/data/PG_VERSION* +*/home/postgres/data/postgresql.conf* +*/home/user/lighttpd/lighttpd.conf* +*/http/httpd.conf* +*/[JBOSS]/server/default/conf/jboss-minimal.xml* +*/[JBOSS]/server/default/conf/jboss-service.xml* +*/[JBOSS]/server/default/conf/jndi.properties* +*/[JBOSS]/server/default/conf/log4j.xml* +*/[JBOSS]/server/default/conf/login-config.xml* +*/[JBOSS]/server/default/conf/server.log.properties* +*/[JBOSS]/server/default/conf/standardjaws.xml* +*/[JBOSS]/server/default/conf/standardjboss.xml* +*/[JBOSS]/server/default/deploy/jboss-logging.xml* +*/[JBOSS]/server/default/log/boot.log* +*/[JBOSS]/server/default/log/server.log* +*/Library/WebServer/Documents/default.htm* +*/Library/WebServer/Documents/default.html* +*/Library/WebServer/Documents/default.php* +*/Library/WebServer/Documents/.htaccess* +*/Library/WebServer/Documents/index.htm* +*/Library/WebServer/Documents/index.html* +*/Library/WebServer/Documents/index.php* +*/logs/access.log* +*/logs/access_log* +*/logs/error.log* +*/logs/error_log* +*/logs/pure-ftpd.log* +*/logs/security_debug_log* +*/logs/security_log* +*/mysql/bin/my.ini* +*/MySQL/data/{HOST}.err* +*/MySQL/data/mysql-bin.index* +*/MySQL/data/mysql-bin.log* +*/MySQL/data/mysql.err* +*/MySQL/data/mysql.log* +*/MySQL/my.cnf* +*/MySQL/my.ini* +*/NetServer/bin/stable/apache/php.ini* +*/NetServerbinstableapachephp.ini* +*/opt/apache22/conf/httpd.conf* +*/opt/apache2/apache2.conf* +*/opt/apache2/apache.conf* +*/opt/apache2/conf/apache2.conf* +*/opt/apache2/conf/apache.conf* +*/opt/apache2/conf/httpd.conf* +*/opt/apache/apache2.conf* +*/opt/apache/apache.conf* +*/opt/apache/conf/apache2.conf* +*/opt/apache/conf/apache.conf* +*/opt/apache/conf/httpd.conf* +*/opt/httpd/apache2.conf* +*/opt/httpd/apache.conf* +*/opt/httpd/conf/apache2.conf* +*/opt/httpd/conf/apache.conf* +*/opt/[JBOSS]/server/default/conf/jboss-minimal.xml* +*/opt/[JBOSS]/server/default/conf/jboss-service.xml* +*/opt/[JBOSS]/server/default/conf/jndi.properties* +*/opt/[JBOSS]/server/default/conf/log4j.xml* +*/opt/[JBOSS]/server/default/conf/login-config.xml* +*/opt/[JBOSS]/server/default/conf/server.log.properties* +*/opt/[JBOSS]/server/default/conf/standardjaws.xml* +*/opt/[JBOSS]/server/default/conf/standardjboss.xml* +*/opt/[JBOSS]/server/default/deploy/jboss-logging.xml* +*/opt/[JBOSS]/server/default/log/boot.log* +*/opt/[JBOSS]/server/default/log/server.log* +*/opt/lampp/etc/httpd.conf* +*/opt/lampp/logs/access.log* +*/opt/lampp/logs/access_log* +*/opt/lampp/logs/error.log* +*/opt/lampp/logs/error_log* +*/opt/lsws/conf/httpd_conf.xml* +*/opt/lsws/logs/access.log* +*/opt/lsws/logs/error.log* +*/opt/tomcat/logs/catalina.err* +*/opt/tomcat/logs/catalina.out* +*/opt/xampp/etc/php.ini* +*/opt/xampp/logs/access.log* +*/opt/xampp/logs/access_log* +*/opt/xampp/logs/error.log* +*/opt/xampp/logs/error_log* +*/private/etc/httpd/apache2.conf* +*/private/etc/httpd/apache.conf* +*/private/etc/httpd/httpd.conf* +*/private/etc/httpd/httpd.conf.default* +*/private/etc/squirrelmail/config/config.php* +*/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml* +*/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml* +*/private/tmp/[JBOSS]/server/default/conf/jndi.properties* +*/private/tmp/[JBOSS]/server/default/conf/log4j.xml* +*/private/tmp/[JBOSS]/server/default/conf/login-config.xml* +*/private/tmp/[JBOSS]/server/default/conf/server.log.properties* +*/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml* +*/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml* +*/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml* +*/private/tmp/[JBOSS]/server/default/log/boot.log* +*/private/tmp/[JBOSS]/server/default/log/server.log* +*/proc/cpuinfo* +*/proc/devices* +*/proc/meminfo* +*/proc/net/tcp* +*/proc/net/udp* +*/proc/self/cmdline* +*/proc/self/environ* +*/proc/self/mounts* +*/proc/self/stat* +*/proc/self/status* +*/proc/version* +*/Program Files/Apache Group/Apache2/conf/apache2.conf* +*/Program Files/Apache Group/Apache2/conf/apache.conf* +*/Program Files/Apache Group/Apache2/conf/httpd.conf* +*/Program FilesApache GroupApache2confhttpd.conf* +*/Program Files/Apache Group/Apache/apache2.conf* +*/Program Files/Apache Group/Apache/apache.conf* +*/Program Files/Apache Group/Apache/conf/apache2.conf* +*/Program Files/Apache Group/Apache/conf/apache.conf* +*/Program Files/Apache Group/Apache/conf/httpd.conf* +*/Program FilesApache GroupApacheconfhttpd.conf* +*/Program Files/Apache Group/Apache/logs/access.log* +*/Program FilesApache GroupApachelogsaccess.log* +*/Program Files/Apache Group/Apache/logs/error.log* +*/Program FilesApache GroupApachelogserror.log* +*/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml* +*/Program Files/[JBOSS]/server/default/conf/jboss-service.xml* +*/Program Files/[JBOSS]/server/default/conf/jndi.properties* +*/Program Files/[JBOSS]/server/default/conf/log4j.xml* +*/Program Files/[JBOSS]/server/default/conf/login-config.xml* +*/Program Files/[JBOSS]/server/default/conf/server.log.properties* +*/Program Files/[JBOSS]/server/default/conf/standardjaws.xml* +*/Program Files/[JBOSS]/server/default/conf/standardjboss.xml* +*/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml* +*/Program Files/[JBOSS]/server/default/log/boot.log* +*/Program Files/[JBOSS]/server/default/log/server.log* +*/Program Files/MySQL/data/{HOST}.err* +*/Program Files/MySQL/data/mysql-bin.index* +*/Program Files/MySQL/data/mysql-bin.log* +*/Program Files/MySQL/data/mysql.err* +*/Program Files/MySQL/data/mysql.log* +*/Program Files/MySQL/my.cnf* +*/Program Files/MySQL/my.ini* +*/Program Files/Vidalia Bundle/Polipo/polipo.conf* +*/Program Files/xampp/apache/conf/apache2.conf* +*/Program Files/xampp/apache/conf/apache.conf* +*/Program Files/xampp/apache/conf/httpd.conf* +*/Program Filesxamppapacheconfhttpd.conf* +*/root/.bash_config* +*/root/.bash_history* +*/root/.bash_logout* +*/root/.bashrc* +*/root/.ksh_history* +*/root/.Xauthority* +*/srv/www/htdos/squirrelmail/config/config.php* +*/tmp/access.log* +*/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml* +*/tmp/[JBOSS]/server/default/conf/jboss-service.xml* +*/tmp/[JBOSS]/server/default/conf/jndi.properties* +*/tmp/[JBOSS]/server/default/conf/log4j.xml* +*/tmp/[JBOSS]/server/default/conf/login-config.xml* +*/tmp/[JBOSS]/server/default/conf/server.log.properties* +*/tmp/[JBOSS]/server/default/conf/standardjaws.xml* +*/tmp/[JBOSS]/server/default/conf/standardjboss.xml* +*/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml* +*/tmp/[JBOSS]/server/default/log/boot.log* +*/tmp/[JBOSS]/server/default/log/server.log* +*/usr/apache2/conf/httpd.conf* +*/usr/apache/conf/httpd.conf* +*/usr/etc/pure-ftpd.conf* +*/usr/home/user/lighttpd/lighttpd.conf* +*/usr/home/user/var/log/apache.log* +*/usr/home/user/var/log/lighttpd.error.log* +*/usr/internet/pgsql/data/pg_hba.conf* +*/usr/internet/pgsql/data/postmaster.log* +*/usr/lib/cron/log* +*/usr/lib/php.ini* +*/usr/lib/php/php.ini* +*/usr/lib/security/mkuser.default* +*/usr/local/apache22/conf/httpd.conf* +*/usr/local/apache22/httpd.conf* +*/usr/local/apache2/apache2.conf* +*/usr/local/apache2/apache.conf* +*/usr/local/apache2/conf/apache2.conf* +*/usr/local/apache2/conf/apache.conf* +*/usr/local/apache2/conf/extra/httpd-ssl.conf* +*/usr/local/apache2/conf/httpd.conf* +*/usr/local/apache2/conf/modsec.conf* +*/usr/local/apache2/conf/ssl.conf* +*/usr/local/apache2/conf/vhosts.conf* +*/usr/local/apache2/conf/vhosts-custom.conf* +*/usr/local/apache2/httpd.conf* +*/usr/local/apache2/logs/access.log* +*/usr/local/apache2/logs/access_log* +*/usr/local/apache2/logs/audit_log* +*/usr/local/apache2/logs/error.log* +*/usr/local/apache2/logs/error_log* +*/usr/local/apache2/logs/lighttpd.error.log* +*/usr/local/apache2/logs/lighttpd.log* +*/usr/local/apache/apache2.conf* +*/usr/local/apache/apache.conf* +*/usr/local/apache/conf/access.conf* +*/usr/local/apache/conf/apache2.conf* +*/usr/local/apache/conf/apache.conf* +*/usr/local/apache/conf/httpd.conf* +*/usr/local/apache/conf/httpd.conf.default* +*/usr/local/apache/conf/modsec.conf* +*/usr/local/apache/conf/php.ini* +*/usr/local/apache/conf/vhosts.conf* +*/usr/local/apache/conf/vhosts-custom.conf* +*/usr/local/apache/httpd.conf* +*/usr/local/apache/logs/access.log* +*/usr/local/apache/logs/access_log* +*/usr/local/apache/logs/audit_log* +*/usr/local/apache/logs/error.log* +*/usr/local/apache/logs/error_log* +*/usr/local/apache/logs/lighttpd.error.log* +*/usr/local/apache/logs/lighttpd.log* +*/usr/local/apache/logs/mod_jk.log* +*/usr/local/apps/apache22/conf/httpd.conf* +*/usr/local/apps/apache2/conf/httpd.conf* +*/usr/local/apps/apache/conf/httpd.conf* +*/usr/local/cpanel/logs* +*/usr/local/cpanel/logs/access_log* +*/usr/local/cpanel/logs/error_log* +*/usr/local/cpanel/logs/license_log* +*/usr/local/cpanel/logs/login_log* +*/usr/local/cpanel/logs/stats_log* +*/usr/local/etc/apache22/conf/httpd.conf* +*/usr/local/etc/apache22/httpd.conf* +*/usr/local/etc/apache2/conf/httpd.conf* +*/usr/local/etc/apache2/httpd.conf* +*/usr/local/etc/apache2/vhosts.conf* +*/usr/local/etc/apache/conf/httpd.conf* +*/usr/local/etc/apache/httpd.conf* +*/usr/local/etc/apache/vhosts.conf* +*/usr/local/etc/httpd/conf* +*/usr/local/etc/httpd/conf/httpd.conf* +*/usr/local/etc/lighttpd.conf* +*/usr/local/etc/lighttpd.conf.new* +*/usr/local/etc/nginx/nginx.conf* +*/usr/local/etc/php.ini* +*/usr/local/etc/pure-ftpd.conf* +*/usr/local/etc/pureftpd.pdb* +*/usr/local/etc/smb.conf* +*/usr/local/etc/webmin/miniserv.conf* +*/usr/local/etc/webmin/miniserv.users* +*/usr/local/httpd/conf/httpd.conf* +*/usr/local/jakarta/dist/tomcat/conf/context.xml* +*/usr/local/jakarta/dist/tomcat/conf/jakarta.conf* +*/usr/local/jakarta/dist/tomcat/conf/logging.properties* +*/usr/local/jakarta/dist/tomcat/conf/server.xml* +*/usr/local/jakarta/dist/tomcat/conf/workers.properties* +*/usr/local/jakarta/dist/tomcat/logs/mod_jk.log* +*/usr/local/jakarta/tomcat/conf/context.xml* +*/usr/local/jakarta/tomcat/conf/jakarta.conf* +*/usr/local/jakarta/tomcat/conf/logging.properties* +*/usr/local/jakarta/tomcat/conf/server.xml* +*/usr/local/jakarta/tomcat/conf/workers.properties* +*/usr/local/jakarta/tomcat/logs/catalina.err* +*/usr/local/jakarta/tomcat/logs/catalina.out* +*/usr/local/jakarta/tomcat/logs/mod_jk.log* +*/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml* +*/usr/local/[JBOSS]/server/default/conf/jboss-service.xml* +*/usr/local/[JBOSS]/server/default/conf/jndi.properties* +*/usr/local/[JBOSS]/server/default/conf/log4j.xml* +*/usr/local/[JBOSS]/server/default/conf/login-config.xml* +*/usr/local/[JBOSS]/server/default/conf/server.log.properties* +*/usr/local/[JBOSS]/server/default/conf/standardjaws.xml* +*/usr/local/[JBOSS]/server/default/conf/standardjboss.xml* +*/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml* +*/usr/local/[JBOSS]/server/default/log/boot.log* +*/usr/local/[JBOSS]/server/default/log/server.log* +*/usr/local/lib/php.ini* +*/usr/local/lighttpd/conf/lighttpd.conf* +*/usr/local/lighttpd/log/access.log* +*/usr/local/lighttpd/log/lighttpd.error.log* +*/usr/local/logs/access.log* +*/usr/local/logs/samba.log* +*/usr/local/lsws/conf/httpd_conf.xml* +*/usr/local/lsws/logs/error.log* +*/usr/local/mysql/data/{HOST}.err* +*/usr/local/mysql/data/mysql-bin.index* +*/usr/local/mysql/data/mysql-bin.log* +*/usr/local/mysql/data/mysqlderror.log* +*/usr/local/mysql/data/mysql.err* +*/usr/local/mysql/data/mysql.log* +*/usr/local/mysql/data/mysql-slow.log* +*/usr/local/nginx/conf/nginx.conf* +*/usr/local/pgsql/bin/pg_passwd* +*/usr/local/pgsql/data/passwd* +*/usr/local/pgsql/data/pg_hba.conf* +*/usr/local/pgsql/data/pg_log* +*/usr/local/pgsql/data/postgresql.conf* +*/usr/local/pgsql/data/postgresql.log* +*/usr/local/php4/apache2.conf* +*/usr/local/php4/apache2.conf.php* +*/usr/local/php4/apache.conf* +*/usr/local/php4/apache.conf.php* +*/usr/local/php4/httpd.conf* +*/usr/local/php4/httpd.conf.php* +*/usr/local/php4/lib/php.ini* +*/usr/local/php5/apache2.conf* +*/usr/local/php5/apache2.conf.php* +*/usr/local/php5/apache.conf* +*/usr/local/php5/apache.conf.php* +*/usr/local/php5/httpd.conf* +*/usr/local/php5/httpd.conf.php* +*/usr/local/php5/lib/php.ini* +*/usr/local/php/apache2.conf* +*/usr/local/php/apache2.conf.php* +*/usr/local/php/apache.conf* +*/usr/local/php/apache.conf.php* +*/usr/local/php/httpd.conf* +*/usr/local/php/httpd.conf.php* +*/usr/local/php/lib/php.ini* +*/usr/local/psa/admin/conf/php.ini* +*/usr/local/psa/admin/conf/site_isolation_settings.ini* +*/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php* +*/usr/local/psa/admin/logs/httpsd_access_log* +*/usr/local/psa/admin/logs/panel.log* +*/usr/local/pureftpd/etc/pure-ftpd.conf* +*/usr/local/pureftpd/etc/pureftpd.pdb* +*/usr/local/pureftpd/sbin/pure-config.pl* +*/usr/local/samba/lib/log.user* +*/usr/local/samba/lib/smb.conf.user* +*/usr/local/sb/config* +*/usr/local/Zend/etc/php.ini* +*/usr/local/zeus/web/global.cfg* +*/usr/local/zeus/web/log/errors* +*/usr/pkg/etc/httpd/httpd.conf* +*/usr/pkg/etc/httpd/httpd-default.conf* +*/usr/pkg/etc/httpd/httpd-vhosts.conf* +*/usr/pkgsrc/net/pureftpd/* +*/usr/pkgsrc/net/pureftpd/pure-ftpd.conf* +*/usr/pkgsrc/net/pureftpd/pureftpd.passwd* +*/usr/pkgsrc/net/pureftpd/pureftpd.pdb* +*/usr/ports/contrib/pure-ftpd/* +*/usr/ports/contrib/pure-ftpd/pure-ftpd.conf* +*/usr/ports/contrib/pure-ftpd/pureftpd.passwd* +*/usr/ports/contrib/pure-ftpd/pureftpd.pdb* +*/usr/ports/ftp/pure-ftpd/* +*/usr/ports/ftp/pure-ftpd/pure-ftpd.conf* +*/usr/ports/ftp/pure-ftpd/pureftpd.passwd* +*/usr/ports/ftp/pure-ftpd/pureftpd.pdb* +*/usr/ports/net/pure-ftpd/* +*/usr/ports/net/pure-ftpd/pure-ftpd.conf* +*/usr/ports/net/pure-ftpd/pureftpd.passwd* +*/usr/ports/net/pure-ftpd/pureftpd.pdb* +*/usr/sbin/mudlogd* +*/usr/sbin/mudpasswd* +*/usr/sbin/pure-config.pl* +*/usr/share/adduser/adduser.conf* +*/usr/share/logs/catalina.err* +*/usr/share/logs/catalina.out* +*/usr/share/squirrelmail/config/config.php* +*/usr/share/squirrelmail/plugins/squirrel_logger/setup.php* +*/usr/share/tomcat6/conf/context.xml* +*/usr/share/tomcat6/conf/logging.properties* +*/usr/share/tomcat6/conf/server.xml* +*/usr/share/tomcat6/conf/workers.properties* +*/usr/share/tomcat6/logs/catalina.err* +*/usr/share/tomcat6/logs/catalina.out* +*/usr/share/tomcat/logs/catalina.err* +*/usr/share/tomcat/logs/catalina.out* +*/usr/spool/lp/log* +*/usr/spool/mqueue/syslog* +*/var/adm/acct/sum/loginlog* +*/var/adm/aculog* +*/var/adm/aculogs* +*/var/adm/crash/unix* +*/var/adm/crash/vmcore* +*/var/adm/cron/log* +*/var/adm/dtmp* +*/var/adm/lastlog/username* +*/var/adm/log/asppp.log* +*/var/adm/loginlog* +*/var/adm/log/xferlog* +*/var/adm/lp/lpd-errs* +*/var/adm/messages* +*/var/adm/pacct* +*/var/adm/qacct* +*/var/adm/ras/bootlog* +*/var/adm/ras/errlog* +*/var/adm/sulog* +*/var/adm/SYSLOG* +*/var/adm/utmp* +*/var/adm/utmpx* +*/var/adm/vold.log* +*/var/adm/wtmp* +*/var/adm/wtmpx* +*/var/adm/X0msgs* +*/var/apache/conf/httpd.conf* +*/var/cpanel/cpanel.config* +*/var/cpanel/tomcat.options* +*/var/cron/log* +*/var/data/mysql-bin.index* +*/var/lib/mysql/my.cnf* +*/var/lib/pgsql/data/postgresql.conf* +*/var/lib/squirrelmail/prefs/squirrelmail.log* +*/var/lighttpd.log* +*/var/local/www/conf/php.ini* +*/var/log/access.log* +*/var/log/access_log* +*/var/log/apache2/access.log* +*/var/log/apache2/access_log* +*/var/log/apache2/error.log* +*/var/log/apache2/error_log* +*/var/log/apache2/squirrelmail.err.log* +*/var/log/apache2/squirrelmail.log* +*/var/log/apache/access.log* +*/var/log/apache/access_log* +*/var/log/apache/error.log* +*/var/log/apache/error_log* +*/var/log/auth.log* +*/var/log/authlog* +*/var/log/boot.log* +*/var/log/cron/var/log/postgres.log* +*/var/log/daemon.log* +*/var/log/daemon.log.1* +*/var/log/data/mysql-bin.index* +*/var/log/dmessage* +*/var/log/error.log* +*/var/log/error_log* +*/var/log/exim/mainlog* +*/var/log/exim_mainlog* +*/var/log/exim/paniclog* +*/var/log/exim_paniclog* +*/var/log/exim/rejectlog* +*/var/log/exim_rejectlog* +*/var/log/ftplog* +*/var/log/ftp-proxy* +*/var/log/ftp-proxy/ftp-proxy.log* +*/var/log/httpd-access.log* +*/var/log/httpd/access.log* +*/var/log/httpd/access_log* +*/var/log/httpd/error.log* +*/var/log/httpd/error_log* +*/var/log/ipfw* +*/var/log/ipfw/ipfw.log* +*/var/log/ipfw.log* +*/var/log/ipfw.today* +*/var/log/kern.log* +*/var/log/kern.log.1* +*/var/log/lighttpd/* +*/var/log/lighttpd.access.log* +*/var/log/lighttpd/access.log* +*/var/log/lighttpd/access.www.log* +*/var/log/lighttpd/{DOMAIN}/access.log* +*/var/log/lighttpd/{DOMAIN}/error.log* +*/var/log/lighttpd.error.log* +*/var/log/lighttpd/error.log* +*/var/log/lighttpd/error.www.log* +*/var/log/log.smb* +*/var/log/mail.err* +*/var/log/mail.info* +*/var/log/mail.log* +*/var/log/maillog* +*/var/log/mail.warn* +*/var/log/messages* +*/var/log/messages.1* +*/var/log/muddleftpd* +*/var/log/muddleftpd.conf* +*/var/log/mysql-bin.index* +*/var/log/mysql/data/mysql-bin.index* +*/var/log/mysqlderror.log* +*/var/log/mysql.err* +*/var/log/mysql.log* +*/var/log/mysql/mysql-bin.index* +*/var/log/mysql/mysql-bin.log* +*/var/log/mysql/mysql.log* +*/var/log/mysql/mysql-slow.log* +*/var/log/news.all* +*/var/log/news/news.all* +*/var/log/news/news.crit* +*/var/log/news/news.err* +*/var/log/news/news.notice* +*/var/log/news/suck.err* +*/var/log/news/suck.notice* +*/var/log/nginx.access_log* +*/var/log/nginx/access.log* +*/var/log/nginx/access_log* +*/var/log/nginx.error_log* +*/var/log/nginx/error.log* +*/var/log/nginx/error_log* +*/var/log/pgsql8.log* +*/var/log/pgsql_log* +*/var/log/pgsql/pgsql.log* +*/var/log/pm-powersave.log* +*/var/log/POPlog* +*/var/log/postgres/pg_backup.log* +*/var/log/postgres/postgres.log* +*/var/log/postgresql.log* +*/var/log/postgresql/main.log* +*/var/log/postgresql/postgres.log* +*/var/log/postgresql/postgresql-8.1-main.log* +*/var/log/postgresql/postgresql-8.3-main.log* +*/var/log/postgresql/postgresql-8.4-main.log* +*/var/log/postgresql/postgresql-9.0-main.log* +*/var/log/postgresql/postgresql-9.1-main.log* +*/var/log/postgresql/postgresql.log* +*/var/log/proftpd* +*/var/log/proftpd.access_log* +*/var/log/proftpd.xferlog* +*/var/log/proftpd/xferlog.legacy* +*/var/log/pureftpd.log* +*/var/log/pure-ftpd/pure-ftpd.log* +*/var/logs/access.log* +*/var/log/samba.log* +*/var/log/samba.log1* +*/var/log/samba.log2* +*/var/log/samba/log.nmbd* +*/var/log/samba/log.smbd* +*/var/log/squirrelmail.log* +*/var/log/sso/sso.log* +*/var/log/sw-cp-server/error_log* +*/var/log/syslog* +*/var/log/syslog.1* +*/var/log/tomcat6/catalina.out* +*/var/log/ufw.log* +*/var/log/user.log* +*/var/log/user.log.1* +*/var/log/vmware/hostd-1.log* +*/var/log/vmware/hostd.log* +*/var/log/vsftpd.log* +*/var/log/webmin/miniserv.log* +*/var/log/xferlog* +*/var/log/Xorg.0.log* +*/var/lp/logs/lpNet* +*/var/lp/logs/lpsched* +*/var/lp/logs/requests* +*/var/mail/root* +*/var/mysql-bin.index* +*/var/mysql.log* +*/var/nm2/postgresql.conf* +*/var/postgresql/db/postgresql.conf* +*/var/postgresql/log/postgresql.log* +*/var/saf/_log* +*/var/saf/port/log* +*/var/spool/cron/crontabs/root* +*/var/spool/cron/crontabs/root* +*/var/www/conf* +*/var/www/conf/httpd.conf* +*/var/www/html/squirrelmail/config/config.php* +*/var/www/.lighttpdpassword* +*/var/www/logs/access.log* +*/var/www/logs/access_log* +*/var/www/logs/error.log* +*/var/www/logs/error_log* +*/var/www/squirrelmail/config/config.php* +*/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf* +*/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf* +*/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf* +*/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php* +*/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php* +*/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php* +*/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini* +*/Volumes/webBackup/opt/apache2/conf/httpd.conf* +*/Volumes/webBackup/private/etc/httpd/httpd.conf* +*/Volumes/webBackup/private/etc/httpd/httpd.conf.default* +*/wamp/bin/apache/apache2.2.21/conf/httpd.conf* +*/wamp/bin/apache/apache2.2.21/logs/access.log* +*/wamp/bin/apache/apache2.2.21/logs/error.log* +*/wamp/bin/apache/apache2.2.21/wampserver.conf* +*/wamp/bin/apache/apache2.2.22/conf/httpd.conf* +*/wamp/bin/apache/apache2.2.22/conf/wampserver.conf* +*/wamp/bin/apache/apache2.2.22/logs/access.log* +*/wamp/bin/apache/apache2.2.22/logs/error.log* +*/wamp/bin/apache/apache2.2.22/wampserver.conf* +*/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index* +*/wamp/bin/mysql/mysql5.5.16/my.ini* +*/wamp/bin/mysql/mysql5.5.16/wampserver.conf* +*/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index* +*/wamp/bin/mysql/mysql5.5.24/my.ini* +*/wamp/bin/mysql/mysql5.5.24/wampserver.conf* +*/wamp/logs/access.log* +*/wamp/logs/apache_error.log* +*/wamp/logs/genquery.log* +*/wamp/logs/mysql.log* +*/wamp/logs/slowquery.log* +*/web/conf/php.ini* +*/WINDOWS/php.ini* +*/WINDOWSphp.ini* +*/WINDOWS/system32/logfiles/MSFTPSVC* +*/WINDOWS/system32/logfiles/MSFTPSVC1* +*/WINDOWS/system32/logfiles/MSFTPSVC2* +*/WINDOWS/system32/logfiles/SMTPSVC* +*/WINDOWS/system32/logfiles/SMTPSVC1* +*/WINDOWS/system32/logfiles/SMTPSVC2* +*/WINDOWS/system32/logfiles/SMTPSVC3* +*/WINDOWS/system32/logfiles/SMTPSVC4* +*/WINDOWS/system32/logfiles/SMTPSVC5* +*/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log* +*/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log* +*/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log* +*/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log* +*/WINNT/php.ini* +*/WINNTphp.ini* +*/WINNT/system32/logfiles/MSFTPSVC* +*/WINNT/system32/logfiles/MSFTPSVC1* +*/WINNT/system32/logfiles/MSFTPSVC2* +*/WINNT/system32/logfiles/SMTPSVC* +*/WINNT/system32/logfiles/SMTPSVC1* +*/WINNT/system32/logfiles/SMTPSVC2* +*/WINNT/system32/logfiles/SMTPSVC3* +*/WINNT/system32/logfiles/SMTPSVC4* +*/WINNT/system32/logfiles/SMTPSVC5* +*/WINNT/system32/logfiles/W3SVC1/inetsvn1.log* +*/WINNT/system32/logfiles/W3SVC2/inetsvn1.log* +*/WINNT/system32/logfiles/W3SVC3/inetsvn1.log* +*/WINNT/system32/logfiles/W3SVC/inetsvn1.log* +*/www/apache/conf/httpd.conf* +*/www/conf/httpd.conf* +*/www/logs/freebsddiary-access_log* +*/www/logs/freebsddiary-error.log* +*/www/logs/proftpd.system.log* +*/xampp/apache/bin/php.ini* +*/xamppapachebinphp.ini* +*/xampp/apache/conf/httpd.conf* +*/xampp/apache/logs/access.log* +*/xampp/apache/logs/error.log* +*/xampp/FileZillaFTP/FileZilla Server.xml* +*/xampp/htdocs/aca.txt* +*/xampp/htdocs/admin.php* +*/xampp/htdocs/leer.txt* +*/xampp/MercuryMail/mercury.ini* +*/xampp/mysql/data/{HOST}.err* +*/xampp/mysql/data/mysql-bin.index* +*/xampp/mysql/data/mysql.err* +*/xampp/phpMyAdmin/config.inc.php* +*/xampp/php/php.ini* +*/xampp/sendmail/sendmail.ini* +*/xampp/sendmail/sendmail.log* +*/xampp/webalizer/webalizer.conf* +*/proc/self/fd/0* +*/proc/self/fd/1* +*/proc/self/fd/2* +*/proc/self/fd/3* +*/proc/self/fd/4* +*/proc/self/fd/5* +*/proc/self/fd/6* +*/proc/self/fd/7* +*/proc/self/fd/8* +*/proc/self/fd/9* +*/proc/self/fd/10* +*/proc/self/fd/11* +*/proc/self/fd/12* +*/proc/self/fd/13* +*/proc/self/fd/14* +*/proc/self/fd/15* +*/proc/self/fd/16* +*/proc/self/fd/17* +*/proc/self/fd/18* +*/proc/self/fd/19* +*/proc/self/fd/20* +*/proc/self/fd/21* +*/proc/self/fd/22* +*/proc/self/fd/23* +*/proc/self/fd/24* +*/proc/self/fd/25* +*/proc/self/fd/26* +*/proc/self/fd/27* +*/proc/self/fd/28* +*/proc/self/fd/29* +*/proc/self/fd/30* +*/proc/self/fd/31* +*/proc/self/fd/32* +*/proc/self/fd/33* +*/proc/self/fd/34* +*/proc/self/fd/35* +*/proc/self/fd/36* +*/proc/self/fd/37* +*/proc/self/fd/38* +*/proc/self/fd/39* +*/proc/self/fd/40* +*/proc/self/fd/41* +*/proc/self/fd/42* +*/proc/self/fd/43* +*/proc/self/fd/44* +*/proc/self/fd/45* +*/proc/self/fd/46* +*/proc/self/fd/47* +*/proc/self/fd/48* +*/proc/self/fd/49* +*/proc/self/fd/50* +*/proc/self/fd/51* +*/proc/self/fd/52* +*/proc/self/fd/53* +*/proc/self/fd/54* +*/proc/self/fd/55* +*/proc/self/fd/56* +*/proc/self/fd/57* +*/proc/self/fd/58* +*/proc/self/fd/59* +*/proc/self/fd/60* +*/proc/self/fd/61* +*/proc/self/fd/62* +*/proc/self/fd/63* +*/proc/self/fd/64* +*/proc/self/fd/65* +*/proc/self/fd/66* +*/proc/self/fd/67* +*/proc/self/fd/68* +*/proc/self/fd/69* +*/proc/self/fd/70* +*/proc/self/fd/71* +*/proc/self/fd/72* +*/proc/self/fd/73* +*/proc/self/fd/74* +*/proc/self/fd/75* +*/proc/self/fd/76* +*/proc/self/fd/77* +*/proc/self/fd/78* +*/proc/self/fd/79* +*/proc/self/fd/80* +*/proc/self/fd/81* +*/proc/self/fd/82* +*/proc/self/fd/83* +*/proc/self/fd/84* +*/proc/self/fd/85* +*/proc/self/fd/86* +*/proc/self/fd/87* +*/proc/self/fd/88* +*/proc/self/fd/89* +*/proc/self/fd/90* +*/proc/self/fd/91* +*/proc/self/fd/92* +*/proc/self/fd/93* +*/proc/self/fd/94* +*/proc/self/fd/95* +*/proc/self/fd/96* +*/proc/self/fd/97* +*/proc/self/fd/98* +*/proc/self/fd/99* +*/proc/self/fd/100* \ No newline at end of file From bbf0a39460708c1df997d80abee2ad48ddb1275f Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 13:07:23 +0200 Subject: [PATCH 09/70] new detection --- lookups/local_file_inclusion_paths.csv | 2018 ++++++++++++------------ 1 file changed, 1009 insertions(+), 1009 deletions(-) diff --git a/lookups/local_file_inclusion_paths.csv b/lookups/local_file_inclusion_paths.csv index ae121fcf9c..f0a0de38a5 100644 --- a/lookups/local_file_inclusion_paths.csv +++ b/lookups/local_file_inclusion_paths.csv @@ -1,1009 +1,1009 @@ -local_file_inclusion_paths -*/apache2/logs/access.log* -*/apache2/logs/error.log* -*/apache/conf/httpd.conf* -*/apache/logs/access.log* -*/apache/logs/error.log* -*/apache/php/php.ini* -*/apachephpphp.ini* -*/bin/php.ini* -*/boot/grub/grub.cfg* -*/boot/grub/menu.lst* -*/etc/adduser.conf* -*/etc/alias* -*/etc/apache22/conf/httpd.conf* -*/etc/apache22/httpd.conf* -*/etc/apache2/apache2.conf* -*/etc/apache2/apache.conf* -*/etc/apache2/conf/httpd.conf* -*/etc/apache2/default-server.conf* -*/etc/apache2/envvars* -*/etc/apache2/httpd2.conf* -*/etc/apache2/httpd.conf* -*/etc/apache2/mods-available/autoindex.conf* -*/etc/apache2/mods-available/deflate.conf* -*/etc/apache2/mods-available/dir.conf* -*/etc/apache2/mods-available/mem_cache.conf* -*/etc/apache2/mods-available/mime.conf* -*/etc/apache2/mods-available/proxy.conf* -*/etc/apache2/mods-available/setenvif.conf* -*/etc/apache2/mods-available/ssl.conf* -*/etc/apache2/mods-enabled/alias.conf* -*/etc/apache2/mods-enabled/deflate.conf* -*/etc/apache2/mods-enabled/dir.conf* -*/etc/apache2/mods-enabled/mime.conf* -*/etc/apache2/mods-enabled/negotiation.conf* -*/etc/apache2/mods-enabled/php5.conf* -*/etc/apache2/mods-enabled/status.conf* -*/etc/apache2/ports.conf* -*/etc/apache2/sites-available/default* -*/etc/apache2/sites-available/default-ssl* -*/etc/apache2/sites-enabled/000-default* -*/etc/apache2/sites-enabled/default* -*/etc/apache2/ssl-global.conf* -*/etc/apache/access.conf* -*/etc/apache/apache.conf* -*/etc/apache/conf/httpd.conf* -*/etc/apache/default-server.conf* -*/etc/apache/httpd.conf* -*/etc/apt/apt.conf* -*/etc/avahi/avahi-daemon.conf* -*/etc/bash.bashrc* -*/etc/bluetooth/input.conf* -*/etc/bluetooth/main.conf* -*/etc/bluetooth/network.conf* -*/etc/bluetooth/rfcomm.conf* -*/etc/ca-certificates.conf* -*/etc/ca-certificates.conf.dpkg-old* -*/etc/casper.conf* -*/etc/chkrootkit.conf* -*/etc/chrootUsers* -*/etc/clamav/clamd.conf* -*/etc/clamav/freshclam.conf* -*/etc/crontab* -*/etc/crypttab* -*/etc/cups/acroread.conf* -*/etc/cups/cupsd.conf* -*/etc/cups/cupsd.conf.default* -*/etc/cups/pdftops.conf* -*/etc/cups/printers.conf* -*/etc/cvs-cron.conf* -*/etc/cvs-pserver.conf* -*/etc/debconf.conf* -*/etc/debian_version* -*/etc/default/grub* -*/etc/deluser.conf* -*/etc/dhcp3/dhclient.conf* -*/etc/dhcp3/dhcpd.conf* -*/etc/dhcp/dhclient.conf* -*/etc/dns2tcpd.conf* -*/etc/e2fsck.conf* -*/etc/esound/esd.conf* -*/etc/etter.conf* -*/etc/exports* -*/etc/fedora-release* -*/etc/firewall.rules* -*/etc/foremost.conf* -*/etc/fstab* -*/etc/ftpchroot* -*/etc/ftphosts* -*/etc/ftpusers* -*/etc/fuse.conf* -*/etc/group* -*/etc/group-* -*/etc/hdparm.conf* -*/etc/host.conf* -*/etc/hostname* -*/etc/hosts* -*/etc/hosts.allow* -*/etc/hosts.deny* -*/etc/http/conf/httpd.conf* -*/etc/httpd/apache2.conf* -*/etc/httpd/apache.conf* -*/etc/httpd.conf* -*/etc/httpd/conf* -*/etc/httpd/conf/apache2.conf* -*/etc/httpd/conf/apache.conf* -*/etc/httpd/conf.d* -*/etc/httpd/conf/httpd.conf* -*/etc/httpd/extra/httpd-ssl.conf* -*/etc/httpd/httpd.conf* -*/etc/httpd/logs/acces.log* -*/etc/httpd/logs/acces_log* -*/etc/httpd/logs/access.log* -*/etc/httpd/logs/access_log* -*/etc/httpd/logs/error.log* -*/etc/httpd/logs/error_log* -*/etc/httpd/mod_php.conf* -*/etc/httpd/php.ini* -*/etc/http/httpd.conf* -*/etc/inetd.conf* -*/etc/init.d* -*/etc/inittab* -*/etc/ipfw.conf* -*/etc/ipfw.rules* -*/etc/issue* -*/etc/issue.net* -*/etc/kbd/config* -*/etc/kernel-img.conf* -*/etc/kernel-pkg.conf* -*/etc/ldap/ldap.conf* -*/etc/ld.so.conf* -*/etc/lighttpd/lighthttpd.conf* -*/etc/login.defs* -*/etc/logrotate.conf* -*/etc/ltrace.conf* -*/etc/mail/sendmail.conf* -*/etc/mandrake-release* -*/etc/manpath.config* -*/etc/miredo.conf* -*/etc/miredo/miredo.conf* -*/etc/miredo/miredo-server.conf* -*/etc/miredo-server.conf* -*/etc/modules* -*/etc/mono/config* -*/etc/motd* -*/etc/mtab* -*/etc/mtools.conf* -*/etc/muddleftpd.com* -*/etc/muddleftpd/muddleftpd.conf* -*/etc/muddleftpd/muddleftpd.passwd* -*/etc/muddleftpd/mudlog* -*/etc/muddleftpd/mudlogd.conf* -*/etc/muddleftpd/passwd* -*/etc/my.cnf* -*/etc/mysql/my.cnf* -*/etc/networks* -*/etc/nginx/nginx.conf* -*/etc/openldap/ldap.conf* -*/etc/os-release* -*/etc/osxhttpd/osxhttpd.conf* -*/etc/pam.conf* -*/etc/passwd* -*/etc/passwd-* -*/etc/passwd~* -*/etc/password.master* -*/etc/php4/apache2/php.ini* -*/etc/php4/apache/php.ini* -*/etc/php4/cgi/php.ini* -*/etc/php5/apache2/php.ini* -*/etc/php5/apache/php.ini* -*/etc/php5/cgi/php.ini* -*/etc/php/apache2/php.ini* -*/etc/php/apache/php.ini* -*/etc/php/cgi/php.ini* -*/etc/php.ini* -*/etc/phpmyadmin/config.inc.php* -*/etc/php/php4/php.ini* -*/etc/php/php.ini* -*/etc/postgresql/pg_hba.conf* -*/etc/postgresql/postgresql.conf* -*/etc/profile* -*/etc/proftp.conf* -*/etc/proftpd/modules.conf* -*/etc/protpd/proftpd.conf* -*/etc/pulse/client.conf* -*/etc/pure-ftpd.conf* -*/etc/pureftpd.passwd* -*/etc/pureftpd.pdb* -*/etc/pure-ftpd/pure-ftpd.conf* -*/etc/pure-ftpd/pure-ftpd.pdb* -*/etc/pure-ftpd/pureftpd.pdb* -*/etc/rc.conf* -*/etc/redhat-release* -*/etc/resolv.conf* -*/etc/samba/dhcp.conf* -*/etc/samba/netlogon* -*/etc/samba/private/smbpasswd* -*/etc/samba/samba.conf* -*/etc/samba/smb.conf* -*/etc/samba/smb.conf.user* -*/etc/samba/smbpasswd* -*/etc/samba/smbusers* -*/etc/security/access.conf* -*/etc/security/environ* -*/etc/security/failedlogin* -*/etc/security/group* -*/etc/security/group.conf* -*/etc/security/lastlog* -*/etc/security/limits* -*/etc/security/limits.conf* -*/etc/security/namespace.conf* -*/etc/security/opasswd* -*/etc/security/pam_env.conf* -*/etc/security/passwd* -*/etc/security/passwd* -*/etc/security/sepermit.conf* -*/etc/security/time.conf* -*/etc/security/user* -*/etc/sensors3.conf* -*/etc/sensors.conf* -*/etc/shadow* -*/etc/shadow-* -*/etc/shadow~* -*/etc/slackware-release* -*/etc/smb.conf* -*/etc/smbpasswd* -*/etc/smi.conf* -*/etc/squirrelmail/apache.conf* -*/etc/squirrelmail/config/config.php* -*/etc/squirrelmail/config_default.php* -*/etc/squirrelmail/config_local.php* -*/etc/squirrelmail/config.php* -*/etc/squirrelmail/default_pref* -*/etc/squirrelmail/filters_setup.php* -*/etc/squirrelmail/index.php* -*/etc/squirrelmail/sqspell_config.php* -*/etc/ssh/sshd_config* -*/etc/sso/sso_config.ini* -*/etc/stunnel/stunnel.conf* -*/etc/sudoers* -*/etc/SUSE-release* -*/etc/sysconfig/network-scripts/ifcfg-eth0* -*/etc/sysctl.conf* -*/etc/syslog.conf* -*/etc/timezone* -*/etc/tinyproxy/tinyproxy.conf* -*/etc/tor/tor-tsocks.conf* -*/etc/tsocks.conf* -*/etc/updatedb.conf* -*/etc/updatedb.conf.BeforeVMwareToolsInstall* -*/etc/utmp* -*/etc/vhcs2/proftpd/proftpd.conf* -*/etc/vmware-tools/config* -*/etc/vmware-tools/tpvmlp.conf* -*/etc/vmware-tools/vmware-tools-libraries.conf* -*/etc/vsftpd.chroot_list* -*/etc/vsftpd.conf* -*/etc/vsftpd/vsftpd.conf* -*/etc/webmin/miniserv.conf* -*/etc/webmin/miniserv.users* -*/etc/wicd/dhclient.conf.template.default* -*/etc/wicd/manager-settings.conf* -*/etc/wicd/wired-settings.conf* -*/etc/wicd/wireless-settings.conf* -*/etc/wu-ftpd/ftpaccess* -*/etc/wu-ftpd/ftphosts* -*/etc/wu-ftpd/ftpusers* -*/etc/X11/xorg.conf* -*/etc/X11/xorg.conf.BeforeVMwareToolsInstall* -*/etc/X11/xorg.conf.orig* -*/etc/X11/xorg.conf-vesa* -*/etc/X11/xorg.conf-vmware* -*/home2/bin/stable/apache/php.ini* -*/home2binstableapachephp.ini* -*/home/bin/stable/apache/php.ini* -*/homebinstableapachephp.ini* -*/home/postgres/data/pg_hba.conf* -*/home/postgres/data/pg_ident.conf* -*/home/postgres/data/PG_VERSION* -*/home/postgres/data/postgresql.conf* -*/home/user/lighttpd/lighttpd.conf* -*/http/httpd.conf* -*/[JBOSS]/server/default/conf/jboss-minimal.xml* -*/[JBOSS]/server/default/conf/jboss-service.xml* -*/[JBOSS]/server/default/conf/jndi.properties* -*/[JBOSS]/server/default/conf/log4j.xml* -*/[JBOSS]/server/default/conf/login-config.xml* -*/[JBOSS]/server/default/conf/server.log.properties* -*/[JBOSS]/server/default/conf/standardjaws.xml* -*/[JBOSS]/server/default/conf/standardjboss.xml* -*/[JBOSS]/server/default/deploy/jboss-logging.xml* -*/[JBOSS]/server/default/log/boot.log* -*/[JBOSS]/server/default/log/server.log* -*/Library/WebServer/Documents/default.htm* -*/Library/WebServer/Documents/default.html* -*/Library/WebServer/Documents/default.php* -*/Library/WebServer/Documents/.htaccess* -*/Library/WebServer/Documents/index.htm* -*/Library/WebServer/Documents/index.html* -*/Library/WebServer/Documents/index.php* -*/logs/access.log* -*/logs/access_log* -*/logs/error.log* -*/logs/error_log* -*/logs/pure-ftpd.log* -*/logs/security_debug_log* -*/logs/security_log* -*/mysql/bin/my.ini* -*/MySQL/data/{HOST}.err* -*/MySQL/data/mysql-bin.index* -*/MySQL/data/mysql-bin.log* -*/MySQL/data/mysql.err* -*/MySQL/data/mysql.log* -*/MySQL/my.cnf* -*/MySQL/my.ini* -*/NetServer/bin/stable/apache/php.ini* -*/NetServerbinstableapachephp.ini* -*/opt/apache22/conf/httpd.conf* -*/opt/apache2/apache2.conf* -*/opt/apache2/apache.conf* -*/opt/apache2/conf/apache2.conf* -*/opt/apache2/conf/apache.conf* -*/opt/apache2/conf/httpd.conf* -*/opt/apache/apache2.conf* -*/opt/apache/apache.conf* -*/opt/apache/conf/apache2.conf* -*/opt/apache/conf/apache.conf* -*/opt/apache/conf/httpd.conf* -*/opt/httpd/apache2.conf* -*/opt/httpd/apache.conf* -*/opt/httpd/conf/apache2.conf* -*/opt/httpd/conf/apache.conf* -*/opt/[JBOSS]/server/default/conf/jboss-minimal.xml* -*/opt/[JBOSS]/server/default/conf/jboss-service.xml* -*/opt/[JBOSS]/server/default/conf/jndi.properties* -*/opt/[JBOSS]/server/default/conf/log4j.xml* -*/opt/[JBOSS]/server/default/conf/login-config.xml* -*/opt/[JBOSS]/server/default/conf/server.log.properties* -*/opt/[JBOSS]/server/default/conf/standardjaws.xml* -*/opt/[JBOSS]/server/default/conf/standardjboss.xml* -*/opt/[JBOSS]/server/default/deploy/jboss-logging.xml* -*/opt/[JBOSS]/server/default/log/boot.log* -*/opt/[JBOSS]/server/default/log/server.log* -*/opt/lampp/etc/httpd.conf* -*/opt/lampp/logs/access.log* -*/opt/lampp/logs/access_log* -*/opt/lampp/logs/error.log* -*/opt/lampp/logs/error_log* -*/opt/lsws/conf/httpd_conf.xml* -*/opt/lsws/logs/access.log* -*/opt/lsws/logs/error.log* -*/opt/tomcat/logs/catalina.err* -*/opt/tomcat/logs/catalina.out* -*/opt/xampp/etc/php.ini* -*/opt/xampp/logs/access.log* -*/opt/xampp/logs/access_log* -*/opt/xampp/logs/error.log* -*/opt/xampp/logs/error_log* -*/private/etc/httpd/apache2.conf* -*/private/etc/httpd/apache.conf* -*/private/etc/httpd/httpd.conf* -*/private/etc/httpd/httpd.conf.default* -*/private/etc/squirrelmail/config/config.php* -*/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml* -*/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml* -*/private/tmp/[JBOSS]/server/default/conf/jndi.properties* -*/private/tmp/[JBOSS]/server/default/conf/log4j.xml* -*/private/tmp/[JBOSS]/server/default/conf/login-config.xml* -*/private/tmp/[JBOSS]/server/default/conf/server.log.properties* -*/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml* -*/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml* -*/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml* -*/private/tmp/[JBOSS]/server/default/log/boot.log* -*/private/tmp/[JBOSS]/server/default/log/server.log* -*/proc/cpuinfo* -*/proc/devices* -*/proc/meminfo* -*/proc/net/tcp* -*/proc/net/udp* -*/proc/self/cmdline* -*/proc/self/environ* -*/proc/self/mounts* -*/proc/self/stat* -*/proc/self/status* -*/proc/version* -*/Program Files/Apache Group/Apache2/conf/apache2.conf* -*/Program Files/Apache Group/Apache2/conf/apache.conf* -*/Program Files/Apache Group/Apache2/conf/httpd.conf* -*/Program FilesApache GroupApache2confhttpd.conf* -*/Program Files/Apache Group/Apache/apache2.conf* -*/Program Files/Apache Group/Apache/apache.conf* -*/Program Files/Apache Group/Apache/conf/apache2.conf* -*/Program Files/Apache Group/Apache/conf/apache.conf* -*/Program Files/Apache Group/Apache/conf/httpd.conf* -*/Program FilesApache GroupApacheconfhttpd.conf* -*/Program Files/Apache Group/Apache/logs/access.log* -*/Program FilesApache GroupApachelogsaccess.log* -*/Program Files/Apache Group/Apache/logs/error.log* -*/Program FilesApache GroupApachelogserror.log* -*/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml* -*/Program Files/[JBOSS]/server/default/conf/jboss-service.xml* -*/Program Files/[JBOSS]/server/default/conf/jndi.properties* -*/Program Files/[JBOSS]/server/default/conf/log4j.xml* -*/Program Files/[JBOSS]/server/default/conf/login-config.xml* -*/Program Files/[JBOSS]/server/default/conf/server.log.properties* -*/Program Files/[JBOSS]/server/default/conf/standardjaws.xml* -*/Program Files/[JBOSS]/server/default/conf/standardjboss.xml* -*/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml* -*/Program Files/[JBOSS]/server/default/log/boot.log* -*/Program Files/[JBOSS]/server/default/log/server.log* -*/Program Files/MySQL/data/{HOST}.err* -*/Program Files/MySQL/data/mysql-bin.index* -*/Program Files/MySQL/data/mysql-bin.log* -*/Program Files/MySQL/data/mysql.err* -*/Program Files/MySQL/data/mysql.log* -*/Program Files/MySQL/my.cnf* -*/Program Files/MySQL/my.ini* -*/Program Files/Vidalia Bundle/Polipo/polipo.conf* -*/Program Files/xampp/apache/conf/apache2.conf* -*/Program Files/xampp/apache/conf/apache.conf* -*/Program Files/xampp/apache/conf/httpd.conf* -*/Program Filesxamppapacheconfhttpd.conf* -*/root/.bash_config* -*/root/.bash_history* -*/root/.bash_logout* -*/root/.bashrc* -*/root/.ksh_history* -*/root/.Xauthority* -*/srv/www/htdos/squirrelmail/config/config.php* -*/tmp/access.log* -*/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml* -*/tmp/[JBOSS]/server/default/conf/jboss-service.xml* -*/tmp/[JBOSS]/server/default/conf/jndi.properties* -*/tmp/[JBOSS]/server/default/conf/log4j.xml* -*/tmp/[JBOSS]/server/default/conf/login-config.xml* -*/tmp/[JBOSS]/server/default/conf/server.log.properties* -*/tmp/[JBOSS]/server/default/conf/standardjaws.xml* -*/tmp/[JBOSS]/server/default/conf/standardjboss.xml* -*/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml* -*/tmp/[JBOSS]/server/default/log/boot.log* -*/tmp/[JBOSS]/server/default/log/server.log* -*/usr/apache2/conf/httpd.conf* -*/usr/apache/conf/httpd.conf* -*/usr/etc/pure-ftpd.conf* -*/usr/home/user/lighttpd/lighttpd.conf* -*/usr/home/user/var/log/apache.log* -*/usr/home/user/var/log/lighttpd.error.log* -*/usr/internet/pgsql/data/pg_hba.conf* -*/usr/internet/pgsql/data/postmaster.log* -*/usr/lib/cron/log* -*/usr/lib/php.ini* -*/usr/lib/php/php.ini* -*/usr/lib/security/mkuser.default* -*/usr/local/apache22/conf/httpd.conf* -*/usr/local/apache22/httpd.conf* -*/usr/local/apache2/apache2.conf* -*/usr/local/apache2/apache.conf* -*/usr/local/apache2/conf/apache2.conf* -*/usr/local/apache2/conf/apache.conf* -*/usr/local/apache2/conf/extra/httpd-ssl.conf* -*/usr/local/apache2/conf/httpd.conf* -*/usr/local/apache2/conf/modsec.conf* -*/usr/local/apache2/conf/ssl.conf* -*/usr/local/apache2/conf/vhosts.conf* -*/usr/local/apache2/conf/vhosts-custom.conf* -*/usr/local/apache2/httpd.conf* -*/usr/local/apache2/logs/access.log* -*/usr/local/apache2/logs/access_log* -*/usr/local/apache2/logs/audit_log* -*/usr/local/apache2/logs/error.log* -*/usr/local/apache2/logs/error_log* -*/usr/local/apache2/logs/lighttpd.error.log* -*/usr/local/apache2/logs/lighttpd.log* -*/usr/local/apache/apache2.conf* -*/usr/local/apache/apache.conf* -*/usr/local/apache/conf/access.conf* -*/usr/local/apache/conf/apache2.conf* -*/usr/local/apache/conf/apache.conf* -*/usr/local/apache/conf/httpd.conf* -*/usr/local/apache/conf/httpd.conf.default* -*/usr/local/apache/conf/modsec.conf* -*/usr/local/apache/conf/php.ini* -*/usr/local/apache/conf/vhosts.conf* -*/usr/local/apache/conf/vhosts-custom.conf* -*/usr/local/apache/httpd.conf* -*/usr/local/apache/logs/access.log* -*/usr/local/apache/logs/access_log* -*/usr/local/apache/logs/audit_log* -*/usr/local/apache/logs/error.log* -*/usr/local/apache/logs/error_log* -*/usr/local/apache/logs/lighttpd.error.log* -*/usr/local/apache/logs/lighttpd.log* -*/usr/local/apache/logs/mod_jk.log* -*/usr/local/apps/apache22/conf/httpd.conf* -*/usr/local/apps/apache2/conf/httpd.conf* -*/usr/local/apps/apache/conf/httpd.conf* -*/usr/local/cpanel/logs* -*/usr/local/cpanel/logs/access_log* -*/usr/local/cpanel/logs/error_log* -*/usr/local/cpanel/logs/license_log* -*/usr/local/cpanel/logs/login_log* -*/usr/local/cpanel/logs/stats_log* -*/usr/local/etc/apache22/conf/httpd.conf* -*/usr/local/etc/apache22/httpd.conf* -*/usr/local/etc/apache2/conf/httpd.conf* -*/usr/local/etc/apache2/httpd.conf* -*/usr/local/etc/apache2/vhosts.conf* -*/usr/local/etc/apache/conf/httpd.conf* -*/usr/local/etc/apache/httpd.conf* -*/usr/local/etc/apache/vhosts.conf* -*/usr/local/etc/httpd/conf* -*/usr/local/etc/httpd/conf/httpd.conf* -*/usr/local/etc/lighttpd.conf* -*/usr/local/etc/lighttpd.conf.new* -*/usr/local/etc/nginx/nginx.conf* -*/usr/local/etc/php.ini* -*/usr/local/etc/pure-ftpd.conf* -*/usr/local/etc/pureftpd.pdb* -*/usr/local/etc/smb.conf* -*/usr/local/etc/webmin/miniserv.conf* -*/usr/local/etc/webmin/miniserv.users* -*/usr/local/httpd/conf/httpd.conf* -*/usr/local/jakarta/dist/tomcat/conf/context.xml* -*/usr/local/jakarta/dist/tomcat/conf/jakarta.conf* -*/usr/local/jakarta/dist/tomcat/conf/logging.properties* -*/usr/local/jakarta/dist/tomcat/conf/server.xml* -*/usr/local/jakarta/dist/tomcat/conf/workers.properties* -*/usr/local/jakarta/dist/tomcat/logs/mod_jk.log* -*/usr/local/jakarta/tomcat/conf/context.xml* -*/usr/local/jakarta/tomcat/conf/jakarta.conf* -*/usr/local/jakarta/tomcat/conf/logging.properties* -*/usr/local/jakarta/tomcat/conf/server.xml* -*/usr/local/jakarta/tomcat/conf/workers.properties* -*/usr/local/jakarta/tomcat/logs/catalina.err* -*/usr/local/jakarta/tomcat/logs/catalina.out* -*/usr/local/jakarta/tomcat/logs/mod_jk.log* -*/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml* -*/usr/local/[JBOSS]/server/default/conf/jboss-service.xml* -*/usr/local/[JBOSS]/server/default/conf/jndi.properties* -*/usr/local/[JBOSS]/server/default/conf/log4j.xml* -*/usr/local/[JBOSS]/server/default/conf/login-config.xml* -*/usr/local/[JBOSS]/server/default/conf/server.log.properties* -*/usr/local/[JBOSS]/server/default/conf/standardjaws.xml* -*/usr/local/[JBOSS]/server/default/conf/standardjboss.xml* -*/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml* -*/usr/local/[JBOSS]/server/default/log/boot.log* -*/usr/local/[JBOSS]/server/default/log/server.log* -*/usr/local/lib/php.ini* -*/usr/local/lighttpd/conf/lighttpd.conf* -*/usr/local/lighttpd/log/access.log* -*/usr/local/lighttpd/log/lighttpd.error.log* -*/usr/local/logs/access.log* -*/usr/local/logs/samba.log* -*/usr/local/lsws/conf/httpd_conf.xml* -*/usr/local/lsws/logs/error.log* -*/usr/local/mysql/data/{HOST}.err* -*/usr/local/mysql/data/mysql-bin.index* -*/usr/local/mysql/data/mysql-bin.log* -*/usr/local/mysql/data/mysqlderror.log* -*/usr/local/mysql/data/mysql.err* -*/usr/local/mysql/data/mysql.log* -*/usr/local/mysql/data/mysql-slow.log* -*/usr/local/nginx/conf/nginx.conf* -*/usr/local/pgsql/bin/pg_passwd* -*/usr/local/pgsql/data/passwd* -*/usr/local/pgsql/data/pg_hba.conf* -*/usr/local/pgsql/data/pg_log* -*/usr/local/pgsql/data/postgresql.conf* -*/usr/local/pgsql/data/postgresql.log* -*/usr/local/php4/apache2.conf* -*/usr/local/php4/apache2.conf.php* -*/usr/local/php4/apache.conf* -*/usr/local/php4/apache.conf.php* -*/usr/local/php4/httpd.conf* -*/usr/local/php4/httpd.conf.php* -*/usr/local/php4/lib/php.ini* -*/usr/local/php5/apache2.conf* -*/usr/local/php5/apache2.conf.php* -*/usr/local/php5/apache.conf* -*/usr/local/php5/apache.conf.php* -*/usr/local/php5/httpd.conf* -*/usr/local/php5/httpd.conf.php* -*/usr/local/php5/lib/php.ini* -*/usr/local/php/apache2.conf* -*/usr/local/php/apache2.conf.php* -*/usr/local/php/apache.conf* -*/usr/local/php/apache.conf.php* -*/usr/local/php/httpd.conf* -*/usr/local/php/httpd.conf.php* -*/usr/local/php/lib/php.ini* -*/usr/local/psa/admin/conf/php.ini* -*/usr/local/psa/admin/conf/site_isolation_settings.ini* -*/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php* -*/usr/local/psa/admin/logs/httpsd_access_log* -*/usr/local/psa/admin/logs/panel.log* -*/usr/local/pureftpd/etc/pure-ftpd.conf* -*/usr/local/pureftpd/etc/pureftpd.pdb* -*/usr/local/pureftpd/sbin/pure-config.pl* -*/usr/local/samba/lib/log.user* -*/usr/local/samba/lib/smb.conf.user* -*/usr/local/sb/config* -*/usr/local/Zend/etc/php.ini* -*/usr/local/zeus/web/global.cfg* -*/usr/local/zeus/web/log/errors* -*/usr/pkg/etc/httpd/httpd.conf* -*/usr/pkg/etc/httpd/httpd-default.conf* -*/usr/pkg/etc/httpd/httpd-vhosts.conf* -*/usr/pkgsrc/net/pureftpd/* -*/usr/pkgsrc/net/pureftpd/pure-ftpd.conf* -*/usr/pkgsrc/net/pureftpd/pureftpd.passwd* -*/usr/pkgsrc/net/pureftpd/pureftpd.pdb* -*/usr/ports/contrib/pure-ftpd/* -*/usr/ports/contrib/pure-ftpd/pure-ftpd.conf* -*/usr/ports/contrib/pure-ftpd/pureftpd.passwd* -*/usr/ports/contrib/pure-ftpd/pureftpd.pdb* -*/usr/ports/ftp/pure-ftpd/* -*/usr/ports/ftp/pure-ftpd/pure-ftpd.conf* -*/usr/ports/ftp/pure-ftpd/pureftpd.passwd* -*/usr/ports/ftp/pure-ftpd/pureftpd.pdb* -*/usr/ports/net/pure-ftpd/* -*/usr/ports/net/pure-ftpd/pure-ftpd.conf* -*/usr/ports/net/pure-ftpd/pureftpd.passwd* -*/usr/ports/net/pure-ftpd/pureftpd.pdb* -*/usr/sbin/mudlogd* -*/usr/sbin/mudpasswd* -*/usr/sbin/pure-config.pl* -*/usr/share/adduser/adduser.conf* -*/usr/share/logs/catalina.err* -*/usr/share/logs/catalina.out* -*/usr/share/squirrelmail/config/config.php* -*/usr/share/squirrelmail/plugins/squirrel_logger/setup.php* -*/usr/share/tomcat6/conf/context.xml* -*/usr/share/tomcat6/conf/logging.properties* -*/usr/share/tomcat6/conf/server.xml* -*/usr/share/tomcat6/conf/workers.properties* -*/usr/share/tomcat6/logs/catalina.err* -*/usr/share/tomcat6/logs/catalina.out* -*/usr/share/tomcat/logs/catalina.err* -*/usr/share/tomcat/logs/catalina.out* -*/usr/spool/lp/log* -*/usr/spool/mqueue/syslog* -*/var/adm/acct/sum/loginlog* -*/var/adm/aculog* -*/var/adm/aculogs* -*/var/adm/crash/unix* -*/var/adm/crash/vmcore* -*/var/adm/cron/log* -*/var/adm/dtmp* -*/var/adm/lastlog/username* -*/var/adm/log/asppp.log* -*/var/adm/loginlog* -*/var/adm/log/xferlog* -*/var/adm/lp/lpd-errs* -*/var/adm/messages* -*/var/adm/pacct* -*/var/adm/qacct* -*/var/adm/ras/bootlog* -*/var/adm/ras/errlog* -*/var/adm/sulog* -*/var/adm/SYSLOG* -*/var/adm/utmp* -*/var/adm/utmpx* -*/var/adm/vold.log* -*/var/adm/wtmp* -*/var/adm/wtmpx* -*/var/adm/X0msgs* -*/var/apache/conf/httpd.conf* -*/var/cpanel/cpanel.config* -*/var/cpanel/tomcat.options* -*/var/cron/log* -*/var/data/mysql-bin.index* -*/var/lib/mysql/my.cnf* -*/var/lib/pgsql/data/postgresql.conf* -*/var/lib/squirrelmail/prefs/squirrelmail.log* -*/var/lighttpd.log* -*/var/local/www/conf/php.ini* -*/var/log/access.log* -*/var/log/access_log* -*/var/log/apache2/access.log* -*/var/log/apache2/access_log* -*/var/log/apache2/error.log* -*/var/log/apache2/error_log* -*/var/log/apache2/squirrelmail.err.log* -*/var/log/apache2/squirrelmail.log* -*/var/log/apache/access.log* -*/var/log/apache/access_log* -*/var/log/apache/error.log* -*/var/log/apache/error_log* -*/var/log/auth.log* -*/var/log/authlog* -*/var/log/boot.log* -*/var/log/cron/var/log/postgres.log* -*/var/log/daemon.log* -*/var/log/daemon.log.1* -*/var/log/data/mysql-bin.index* -*/var/log/dmessage* -*/var/log/error.log* -*/var/log/error_log* -*/var/log/exim/mainlog* -*/var/log/exim_mainlog* -*/var/log/exim/paniclog* -*/var/log/exim_paniclog* -*/var/log/exim/rejectlog* -*/var/log/exim_rejectlog* -*/var/log/ftplog* -*/var/log/ftp-proxy* -*/var/log/ftp-proxy/ftp-proxy.log* -*/var/log/httpd-access.log* -*/var/log/httpd/access.log* -*/var/log/httpd/access_log* -*/var/log/httpd/error.log* -*/var/log/httpd/error_log* -*/var/log/ipfw* -*/var/log/ipfw/ipfw.log* -*/var/log/ipfw.log* -*/var/log/ipfw.today* -*/var/log/kern.log* -*/var/log/kern.log.1* -*/var/log/lighttpd/* -*/var/log/lighttpd.access.log* -*/var/log/lighttpd/access.log* -*/var/log/lighttpd/access.www.log* -*/var/log/lighttpd/{DOMAIN}/access.log* -*/var/log/lighttpd/{DOMAIN}/error.log* -*/var/log/lighttpd.error.log* -*/var/log/lighttpd/error.log* -*/var/log/lighttpd/error.www.log* -*/var/log/log.smb* -*/var/log/mail.err* -*/var/log/mail.info* -*/var/log/mail.log* -*/var/log/maillog* -*/var/log/mail.warn* -*/var/log/messages* -*/var/log/messages.1* -*/var/log/muddleftpd* -*/var/log/muddleftpd.conf* -*/var/log/mysql-bin.index* -*/var/log/mysql/data/mysql-bin.index* -*/var/log/mysqlderror.log* -*/var/log/mysql.err* -*/var/log/mysql.log* -*/var/log/mysql/mysql-bin.index* -*/var/log/mysql/mysql-bin.log* -*/var/log/mysql/mysql.log* -*/var/log/mysql/mysql-slow.log* -*/var/log/news.all* -*/var/log/news/news.all* -*/var/log/news/news.crit* -*/var/log/news/news.err* -*/var/log/news/news.notice* -*/var/log/news/suck.err* -*/var/log/news/suck.notice* -*/var/log/nginx.access_log* -*/var/log/nginx/access.log* -*/var/log/nginx/access_log* -*/var/log/nginx.error_log* -*/var/log/nginx/error.log* -*/var/log/nginx/error_log* -*/var/log/pgsql8.log* -*/var/log/pgsql_log* -*/var/log/pgsql/pgsql.log* -*/var/log/pm-powersave.log* -*/var/log/POPlog* -*/var/log/postgres/pg_backup.log* -*/var/log/postgres/postgres.log* -*/var/log/postgresql.log* -*/var/log/postgresql/main.log* -*/var/log/postgresql/postgres.log* -*/var/log/postgresql/postgresql-8.1-main.log* -*/var/log/postgresql/postgresql-8.3-main.log* -*/var/log/postgresql/postgresql-8.4-main.log* -*/var/log/postgresql/postgresql-9.0-main.log* -*/var/log/postgresql/postgresql-9.1-main.log* -*/var/log/postgresql/postgresql.log* -*/var/log/proftpd* -*/var/log/proftpd.access_log* -*/var/log/proftpd.xferlog* -*/var/log/proftpd/xferlog.legacy* -*/var/log/pureftpd.log* -*/var/log/pure-ftpd/pure-ftpd.log* -*/var/logs/access.log* -*/var/log/samba.log* -*/var/log/samba.log1* -*/var/log/samba.log2* -*/var/log/samba/log.nmbd* -*/var/log/samba/log.smbd* -*/var/log/squirrelmail.log* -*/var/log/sso/sso.log* -*/var/log/sw-cp-server/error_log* -*/var/log/syslog* -*/var/log/syslog.1* -*/var/log/tomcat6/catalina.out* -*/var/log/ufw.log* -*/var/log/user.log* -*/var/log/user.log.1* -*/var/log/vmware/hostd-1.log* -*/var/log/vmware/hostd.log* -*/var/log/vsftpd.log* -*/var/log/webmin/miniserv.log* -*/var/log/xferlog* -*/var/log/Xorg.0.log* -*/var/lp/logs/lpNet* -*/var/lp/logs/lpsched* -*/var/lp/logs/requests* -*/var/mail/root* -*/var/mysql-bin.index* -*/var/mysql.log* -*/var/nm2/postgresql.conf* -*/var/postgresql/db/postgresql.conf* -*/var/postgresql/log/postgresql.log* -*/var/saf/_log* -*/var/saf/port/log* -*/var/spool/cron/crontabs/root* -*/var/spool/cron/crontabs/root* -*/var/www/conf* -*/var/www/conf/httpd.conf* -*/var/www/html/squirrelmail/config/config.php* -*/var/www/.lighttpdpassword* -*/var/www/logs/access.log* -*/var/www/logs/access_log* -*/var/www/logs/error.log* -*/var/www/logs/error_log* -*/var/www/squirrelmail/config/config.php* -*/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf* -*/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf* -*/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf* -*/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php* -*/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php* -*/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php* -*/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini* -*/Volumes/webBackup/opt/apache2/conf/httpd.conf* -*/Volumes/webBackup/private/etc/httpd/httpd.conf* -*/Volumes/webBackup/private/etc/httpd/httpd.conf.default* -*/wamp/bin/apache/apache2.2.21/conf/httpd.conf* -*/wamp/bin/apache/apache2.2.21/logs/access.log* -*/wamp/bin/apache/apache2.2.21/logs/error.log* -*/wamp/bin/apache/apache2.2.21/wampserver.conf* -*/wamp/bin/apache/apache2.2.22/conf/httpd.conf* -*/wamp/bin/apache/apache2.2.22/conf/wampserver.conf* -*/wamp/bin/apache/apache2.2.22/logs/access.log* -*/wamp/bin/apache/apache2.2.22/logs/error.log* -*/wamp/bin/apache/apache2.2.22/wampserver.conf* -*/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index* -*/wamp/bin/mysql/mysql5.5.16/my.ini* -*/wamp/bin/mysql/mysql5.5.16/wampserver.conf* -*/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index* -*/wamp/bin/mysql/mysql5.5.24/my.ini* -*/wamp/bin/mysql/mysql5.5.24/wampserver.conf* -*/wamp/logs/access.log* -*/wamp/logs/apache_error.log* -*/wamp/logs/genquery.log* -*/wamp/logs/mysql.log* -*/wamp/logs/slowquery.log* -*/web/conf/php.ini* -*/WINDOWS/php.ini* -*/WINDOWSphp.ini* -*/WINDOWS/system32/logfiles/MSFTPSVC* -*/WINDOWS/system32/logfiles/MSFTPSVC1* -*/WINDOWS/system32/logfiles/MSFTPSVC2* -*/WINDOWS/system32/logfiles/SMTPSVC* -*/WINDOWS/system32/logfiles/SMTPSVC1* -*/WINDOWS/system32/logfiles/SMTPSVC2* -*/WINDOWS/system32/logfiles/SMTPSVC3* -*/WINDOWS/system32/logfiles/SMTPSVC4* -*/WINDOWS/system32/logfiles/SMTPSVC5* -*/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log* -*/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log* -*/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log* -*/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log* -*/WINNT/php.ini* -*/WINNTphp.ini* -*/WINNT/system32/logfiles/MSFTPSVC* -*/WINNT/system32/logfiles/MSFTPSVC1* -*/WINNT/system32/logfiles/MSFTPSVC2* -*/WINNT/system32/logfiles/SMTPSVC* -*/WINNT/system32/logfiles/SMTPSVC1* -*/WINNT/system32/logfiles/SMTPSVC2* -*/WINNT/system32/logfiles/SMTPSVC3* -*/WINNT/system32/logfiles/SMTPSVC4* -*/WINNT/system32/logfiles/SMTPSVC5* -*/WINNT/system32/logfiles/W3SVC1/inetsvn1.log* -*/WINNT/system32/logfiles/W3SVC2/inetsvn1.log* -*/WINNT/system32/logfiles/W3SVC3/inetsvn1.log* -*/WINNT/system32/logfiles/W3SVC/inetsvn1.log* -*/www/apache/conf/httpd.conf* -*/www/conf/httpd.conf* -*/www/logs/freebsddiary-access_log* -*/www/logs/freebsddiary-error.log* -*/www/logs/proftpd.system.log* -*/xampp/apache/bin/php.ini* -*/xamppapachebinphp.ini* -*/xampp/apache/conf/httpd.conf* -*/xampp/apache/logs/access.log* -*/xampp/apache/logs/error.log* -*/xampp/FileZillaFTP/FileZilla Server.xml* -*/xampp/htdocs/aca.txt* -*/xampp/htdocs/admin.php* -*/xampp/htdocs/leer.txt* -*/xampp/MercuryMail/mercury.ini* -*/xampp/mysql/data/{HOST}.err* -*/xampp/mysql/data/mysql-bin.index* -*/xampp/mysql/data/mysql.err* -*/xampp/phpMyAdmin/config.inc.php* -*/xampp/php/php.ini* -*/xampp/sendmail/sendmail.ini* -*/xampp/sendmail/sendmail.log* -*/xampp/webalizer/webalizer.conf* -*/proc/self/fd/0* -*/proc/self/fd/1* -*/proc/self/fd/2* -*/proc/self/fd/3* -*/proc/self/fd/4* -*/proc/self/fd/5* -*/proc/self/fd/6* -*/proc/self/fd/7* -*/proc/self/fd/8* -*/proc/self/fd/9* -*/proc/self/fd/10* -*/proc/self/fd/11* -*/proc/self/fd/12* -*/proc/self/fd/13* -*/proc/self/fd/14* -*/proc/self/fd/15* -*/proc/self/fd/16* -*/proc/self/fd/17* -*/proc/self/fd/18* -*/proc/self/fd/19* -*/proc/self/fd/20* -*/proc/self/fd/21* -*/proc/self/fd/22* -*/proc/self/fd/23* -*/proc/self/fd/24* -*/proc/self/fd/25* -*/proc/self/fd/26* -*/proc/self/fd/27* -*/proc/self/fd/28* -*/proc/self/fd/29* -*/proc/self/fd/30* -*/proc/self/fd/31* -*/proc/self/fd/32* -*/proc/self/fd/33* -*/proc/self/fd/34* -*/proc/self/fd/35* -*/proc/self/fd/36* -*/proc/self/fd/37* -*/proc/self/fd/38* -*/proc/self/fd/39* -*/proc/self/fd/40* -*/proc/self/fd/41* -*/proc/self/fd/42* -*/proc/self/fd/43* -*/proc/self/fd/44* -*/proc/self/fd/45* -*/proc/self/fd/46* -*/proc/self/fd/47* -*/proc/self/fd/48* -*/proc/self/fd/49* -*/proc/self/fd/50* -*/proc/self/fd/51* -*/proc/self/fd/52* -*/proc/self/fd/53* -*/proc/self/fd/54* -*/proc/self/fd/55* -*/proc/self/fd/56* -*/proc/self/fd/57* -*/proc/self/fd/58* -*/proc/self/fd/59* -*/proc/self/fd/60* -*/proc/self/fd/61* -*/proc/self/fd/62* -*/proc/self/fd/63* -*/proc/self/fd/64* -*/proc/self/fd/65* -*/proc/self/fd/66* -*/proc/self/fd/67* -*/proc/self/fd/68* -*/proc/self/fd/69* -*/proc/self/fd/70* -*/proc/self/fd/71* -*/proc/self/fd/72* -*/proc/self/fd/73* -*/proc/self/fd/74* -*/proc/self/fd/75* -*/proc/self/fd/76* -*/proc/self/fd/77* -*/proc/self/fd/78* -*/proc/self/fd/79* -*/proc/self/fd/80* -*/proc/self/fd/81* -*/proc/self/fd/82* -*/proc/self/fd/83* -*/proc/self/fd/84* -*/proc/self/fd/85* -*/proc/self/fd/86* -*/proc/self/fd/87* -*/proc/self/fd/88* -*/proc/self/fd/89* -*/proc/self/fd/90* -*/proc/self/fd/91* -*/proc/self/fd/92* -*/proc/self/fd/93* -*/proc/self/fd/94* -*/proc/self/fd/95* -*/proc/self/fd/96* -*/proc/self/fd/97* -*/proc/self/fd/98* -*/proc/self/fd/99* -*/proc/self/fd/100* \ No newline at end of file +local_file_inclusion_paths, lfi_path +*/apache2/logs/access.log*, yes +*/apache2/logs/error.log*, yes +*/apache/conf/httpd.conf*, yes +*/apache/logs/access.log*, yes +*/apache/logs/error.log*, yes +*/apache/php/php.ini*, yes +*/apachephpphp.ini*, yes +*/bin/php.ini*, yes +*/boot/grub/grub.cfg*, yes +*/boot/grub/menu.lst*, yes +*/etc/adduser.conf*, yes +*/etc/alias*, yes +*/etc/apache22/conf/httpd.conf*, yes +*/etc/apache22/httpd.conf*, yes +*/etc/apache2/apache2.conf*, yes +*/etc/apache2/apache.conf*, yes +*/etc/apache2/conf/httpd.conf*, yes +*/etc/apache2/default-server.conf*, yes +*/etc/apache2/envvars*, yes +*/etc/apache2/httpd2.conf*, yes +*/etc/apache2/httpd.conf*, yes +*/etc/apache2/mods-available/autoindex.conf*, yes +*/etc/apache2/mods-available/deflate.conf*, yes +*/etc/apache2/mods-available/dir.conf*, yes +*/etc/apache2/mods-available/mem_cache.conf*, yes +*/etc/apache2/mods-available/mime.conf*, yes +*/etc/apache2/mods-available/proxy.conf*, yes +*/etc/apache2/mods-available/setenvif.conf*, yes +*/etc/apache2/mods-available/ssl.conf*, yes +*/etc/apache2/mods-enabled/alias.conf*, yes +*/etc/apache2/mods-enabled/deflate.conf*, yes +*/etc/apache2/mods-enabled/dir.conf*, yes +*/etc/apache2/mods-enabled/mime.conf*, yes +*/etc/apache2/mods-enabled/negotiation.conf*, yes +*/etc/apache2/mods-enabled/php5.conf*, yes +*/etc/apache2/mods-enabled/status.conf*, yes +*/etc/apache2/ports.conf*, yes +*/etc/apache2/sites-available/default*, yes +*/etc/apache2/sites-available/default-ssl*, yes +*/etc/apache2/sites-enabled/000-default*, yes +*/etc/apache2/sites-enabled/default*, yes +*/etc/apache2/ssl-global.conf*, yes +*/etc/apache/access.conf*, yes +*/etc/apache/apache.conf*, yes +*/etc/apache/conf/httpd.conf*, yes +*/etc/apache/default-server.conf*, yes +*/etc/apache/httpd.conf*, yes +*/etc/apt/apt.conf*, yes +*/etc/avahi/avahi-daemon.conf*, yes +*/etc/bash.bashrc*, yes +*/etc/bluetooth/input.conf*, yes +*/etc/bluetooth/main.conf*, yes +*/etc/bluetooth/network.conf*, yes +*/etc/bluetooth/rfcomm.conf*, yes +*/etc/ca-certificates.conf*, yes +*/etc/ca-certificates.conf.dpkg-old*, yes +*/etc/casper.conf*, yes +*/etc/chkrootkit.conf*, yes +*/etc/chrootUsers*, yes +*/etc/clamav/clamd.conf*, yes +*/etc/clamav/freshclam.conf*, yes +*/etc/crontab*, yes +*/etc/crypttab*, yes +*/etc/cups/acroread.conf*, yes +*/etc/cups/cupsd.conf*, yes +*/etc/cups/cupsd.conf.default*, yes +*/etc/cups/pdftops.conf*, yes +*/etc/cups/printers.conf*, yes +*/etc/cvs-cron.conf*, yes +*/etc/cvs-pserver.conf*, yes +*/etc/debconf.conf*, yes +*/etc/debian_version*, yes +*/etc/default/grub*, yes +*/etc/deluser.conf*, yes +*/etc/dhcp3/dhclient.conf*, yes +*/etc/dhcp3/dhcpd.conf*, yes +*/etc/dhcp/dhclient.conf*, yes +*/etc/dns2tcpd.conf*, yes +*/etc/e2fsck.conf*, yes +*/etc/esound/esd.conf*, yes +*/etc/etter.conf*, yes +*/etc/exports*, yes +*/etc/fedora-release*, yes +*/etc/firewall.rules*, yes +*/etc/foremost.conf*, yes +*/etc/fstab*, yes +*/etc/ftpchroot*, yes +*/etc/ftphosts*, yes +*/etc/ftpusers*, yes +*/etc/fuse.conf*, yes +*/etc/group*, yes +*/etc/group-*, yes +*/etc/hdparm.conf*, yes +*/etc/host.conf*, yes +*/etc/hostname*, yes +*/etc/hosts*, yes +*/etc/hosts.allow*, yes +*/etc/hosts.deny*, yes +*/etc/http/conf/httpd.conf*, yes +*/etc/httpd/apache2.conf*, yes +*/etc/httpd/apache.conf*, yes +*/etc/httpd.conf*, yes +*/etc/httpd/conf*, yes +*/etc/httpd/conf/apache2.conf*, yes +*/etc/httpd/conf/apache.conf*, yes +*/etc/httpd/conf.d*, yes +*/etc/httpd/conf/httpd.conf*, yes +*/etc/httpd/extra/httpd-ssl.conf*, yes +*/etc/httpd/httpd.conf*, yes +*/etc/httpd/logs/acces.log*, yes +*/etc/httpd/logs/acces_log*, yes +*/etc/httpd/logs/access.log*, yes +*/etc/httpd/logs/access_log*, yes +*/etc/httpd/logs/error.log*, yes +*/etc/httpd/logs/error_log*, yes +*/etc/httpd/mod_php.conf*, yes +*/etc/httpd/php.ini*, yes +*/etc/http/httpd.conf*, yes +*/etc/inetd.conf*, yes +*/etc/init.d*, yes +*/etc/inittab*, yes +*/etc/ipfw.conf*, yes +*/etc/ipfw.rules*, yes +*/etc/issue*, yes +*/etc/issue.net*, yes +*/etc/kbd/config*, yes +*/etc/kernel-img.conf*, yes +*/etc/kernel-pkg.conf*, yes +*/etc/ldap/ldap.conf*, yes +*/etc/ld.so.conf*, yes +*/etc/lighttpd/lighthttpd.conf*, yes +*/etc/login.defs*, yes +*/etc/logrotate.conf*, yes +*/etc/ltrace.conf*, yes +*/etc/mail/sendmail.conf*, yes +*/etc/mandrake-release*, yes +*/etc/manpath.config*, yes +*/etc/miredo.conf*, yes +*/etc/miredo/miredo.conf*, yes +*/etc/miredo/miredo-server.conf*, yes +*/etc/miredo-server.conf*, yes +*/etc/modules*, yes +*/etc/mono/config*, yes +*/etc/motd*, yes +*/etc/mtab*, yes +*/etc/mtools.conf*, yes +*/etc/muddleftpd.com*, yes +*/etc/muddleftpd/muddleftpd.conf*, yes +*/etc/muddleftpd/muddleftpd.passwd*, yes +*/etc/muddleftpd/mudlog*, yes +*/etc/muddleftpd/mudlogd.conf*, yes +*/etc/muddleftpd/passwd*, yes +*/etc/my.cnf*, yes +*/etc/mysql/my.cnf*, yes +*/etc/networks*, yes +*/etc/nginx/nginx.conf*, yes +*/etc/openldap/ldap.conf*, yes +*/etc/os-release*, yes +*/etc/osxhttpd/osxhttpd.conf*, yes +*/etc/pam.conf*, yes +*/etc/passwd*, yes +*/etc/passwd-*, yes +*/etc/passwd~*, yes +*/etc/password.master*, yes +*/etc/php4/apache2/php.ini*, yes +*/etc/php4/apache/php.ini*, yes +*/etc/php4/cgi/php.ini*, yes +*/etc/php5/apache2/php.ini*, yes +*/etc/php5/apache/php.ini*, yes +*/etc/php5/cgi/php.ini*, yes +*/etc/php/apache2/php.ini*, yes +*/etc/php/apache/php.ini*, yes +*/etc/php/cgi/php.ini*, yes +*/etc/php.ini*, yes +*/etc/phpmyadmin/config.inc.php*, yes +*/etc/php/php4/php.ini*, yes +*/etc/php/php.ini*, yes +*/etc/postgresql/pg_hba.conf*, yes +*/etc/postgresql/postgresql.conf*, yes +*/etc/profile*, yes +*/etc/proftp.conf*, yes +*/etc/proftpd/modules.conf*, yes +*/etc/protpd/proftpd.conf*, yes +*/etc/pulse/client.conf*, yes +*/etc/pure-ftpd.conf*, yes +*/etc/pureftpd.passwd*, yes +*/etc/pureftpd.pdb*, yes +*/etc/pure-ftpd/pure-ftpd.conf*, yes +*/etc/pure-ftpd/pure-ftpd.pdb*, yes +*/etc/pure-ftpd/pureftpd.pdb*, yes +*/etc/rc.conf*, yes +*/etc/redhat-release*, yes +*/etc/resolv.conf*, yes +*/etc/samba/dhcp.conf*, yes +*/etc/samba/netlogon*, yes +*/etc/samba/private/smbpasswd*, yes +*/etc/samba/samba.conf*, yes +*/etc/samba/smb.conf*, yes +*/etc/samba/smb.conf.user*, yes +*/etc/samba/smbpasswd*, yes +*/etc/samba/smbusers*, yes +*/etc/security/access.conf*, yes +*/etc/security/environ*, yes +*/etc/security/failedlogin*, yes +*/etc/security/group*, yes +*/etc/security/group.conf*, yes +*/etc/security/lastlog*, yes +*/etc/security/limits*, yes +*/etc/security/limits.conf*, yes +*/etc/security/namespace.conf*, yes +*/etc/security/opasswd*, yes +*/etc/security/pam_env.conf*, yes +*/etc/security/passwd*, yes +*/etc/security/passwd*, yes +*/etc/security/sepermit.conf*, yes +*/etc/security/time.conf*, yes +*/etc/security/user*, yes +*/etc/sensors3.conf*, yes +*/etc/sensors.conf*, yes +*/etc/shadow*, yes +*/etc/shadow-*, yes +*/etc/shadow~*, yes +*/etc/slackware-release*, yes +*/etc/smb.conf*, yes +*/etc/smbpasswd*, yes +*/etc/smi.conf*, yes +*/etc/squirrelmail/apache.conf*, yes +*/etc/squirrelmail/config/config.php*, yes +*/etc/squirrelmail/config_default.php*, yes +*/etc/squirrelmail/config_local.php*, yes +*/etc/squirrelmail/config.php*, yes +*/etc/squirrelmail/default_pref*, yes +*/etc/squirrelmail/filters_setup.php*, yes +*/etc/squirrelmail/index.php*, yes +*/etc/squirrelmail/sqspell_config.php*, yes +*/etc/ssh/sshd_config*, yes +*/etc/sso/sso_config.ini*, yes +*/etc/stunnel/stunnel.conf*, yes +*/etc/sudoers*, yes +*/etc/SUSE-release*, yes +*/etc/sysconfig/network-scripts/ifcfg-eth0*, yes +*/etc/sysctl.conf*, yes +*/etc/syslog.conf*, yes +*/etc/timezone*, yes +*/etc/tinyproxy/tinyproxy.conf*, yes +*/etc/tor/tor-tsocks.conf*, yes +*/etc/tsocks.conf*, yes +*/etc/updatedb.conf*, yes +*/etc/updatedb.conf.BeforeVMwareToolsInstall*, yes +*/etc/utmp*, yes +*/etc/vhcs2/proftpd/proftpd.conf*, yes +*/etc/vmware-tools/config*, yes +*/etc/vmware-tools/tpvmlp.conf*, yes +*/etc/vmware-tools/vmware-tools-libraries.conf*, yes +*/etc/vsftpd.chroot_list*, yes +*/etc/vsftpd.conf*, yes +*/etc/vsftpd/vsftpd.conf*, yes +*/etc/webmin/miniserv.conf*, yes +*/etc/webmin/miniserv.users*, yes +*/etc/wicd/dhclient.conf.template.default*, yes +*/etc/wicd/manager-settings.conf*, yes +*/etc/wicd/wired-settings.conf*, yes +*/etc/wicd/wireless-settings.conf*, yes +*/etc/wu-ftpd/ftpaccess*, yes +*/etc/wu-ftpd/ftphosts*, yes +*/etc/wu-ftpd/ftpusers*, yes +*/etc/X11/xorg.conf*, yes +*/etc/X11/xorg.conf.BeforeVMwareToolsInstall*, yes +*/etc/X11/xorg.conf.orig*, yes +*/etc/X11/xorg.conf-vesa*, yes +*/etc/X11/xorg.conf-vmware*, yes +*/home2/bin/stable/apache/php.ini*, yes +*/home2binstableapachephp.ini*, yes +*/home/bin/stable/apache/php.ini*, yes +*/homebinstableapachephp.ini*, yes +*/home/postgres/data/pg_hba.conf*, yes +*/home/postgres/data/pg_ident.conf*, yes +*/home/postgres/data/PG_VERSION*, yes +*/home/postgres/data/postgresql.conf*, yes +*/home/user/lighttpd/lighttpd.conf*, yes +*/http/httpd.conf*, yes +*/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/[JBOSS]/server/default/conf/jndi.properties*, yes +*/[JBOSS]/server/default/conf/log4j.xml*, yes +*/[JBOSS]/server/default/conf/login-config.xml*, yes +*/[JBOSS]/server/default/conf/server.log.properties*, yes +*/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/[JBOSS]/server/default/log/boot.log*, yes +*/[JBOSS]/server/default/log/server.log*, yes +*/Library/WebServer/Documents/default.htm*, yes +*/Library/WebServer/Documents/default.html*, yes +*/Library/WebServer/Documents/default.php*, yes +*/Library/WebServer/Documents/.htaccess*, yes +*/Library/WebServer/Documents/index.htm*, yes +*/Library/WebServer/Documents/index.html*, yes +*/Library/WebServer/Documents/index.php*, yes +*/logs/access.log*, yes +*/logs/access_log*, yes +*/logs/error.log*, yes +*/logs/error_log*, yes +*/logs/pure-ftpd.log*, yes +*/logs/security_debug_log*, yes +*/logs/security_log*, yes +*/mysql/bin/my.ini*, yes +*/MySQL/data/{HOST}.err*, yes +*/MySQL/data/mysql-bin.index*, yes +*/MySQL/data/mysql-bin.log*, yes +*/MySQL/data/mysql.err*, yes +*/MySQL/data/mysql.log*, yes +*/MySQL/my.cnf*, yes +*/MySQL/my.ini*, yes +*/NetServer/bin/stable/apache/php.ini*, yes +*/NetServerbinstableapachephp.ini*, yes +*/opt/apache22/conf/httpd.conf*, yes +*/opt/apache2/apache2.conf*, yes +*/opt/apache2/apache.conf*, yes +*/opt/apache2/conf/apache2.conf*, yes +*/opt/apache2/conf/apache.conf*, yes +*/opt/apache2/conf/httpd.conf*, yes +*/opt/apache/apache2.conf*, yes +*/opt/apache/apache.conf*, yes +*/opt/apache/conf/apache2.conf*, yes +*/opt/apache/conf/apache.conf*, yes +*/opt/apache/conf/httpd.conf*, yes +*/opt/httpd/apache2.conf*, yes +*/opt/httpd/apache.conf*, yes +*/opt/httpd/conf/apache2.conf*, yes +*/opt/httpd/conf/apache.conf*, yes +*/opt/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/opt/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/opt/[JBOSS]/server/default/conf/jndi.properties*, yes +*/opt/[JBOSS]/server/default/conf/log4j.xml*, yes +*/opt/[JBOSS]/server/default/conf/login-config.xml*, yes +*/opt/[JBOSS]/server/default/conf/server.log.properties*, yes +*/opt/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/opt/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/opt/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/opt/[JBOSS]/server/default/log/boot.log*, yes +*/opt/[JBOSS]/server/default/log/server.log*, yes +*/opt/lampp/etc/httpd.conf*, yes +*/opt/lampp/logs/access.log*, yes +*/opt/lampp/logs/access_log*, yes +*/opt/lampp/logs/error.log*, yes +*/opt/lampp/logs/error_log*, yes +*/opt/lsws/conf/httpd_conf.xml*, yes +*/opt/lsws/logs/access.log*, yes +*/opt/lsws/logs/error.log*, yes +*/opt/tomcat/logs/catalina.err*, yes +*/opt/tomcat/logs/catalina.out*, yes +*/opt/xampp/etc/php.ini*, yes +*/opt/xampp/logs/access.log*, yes +*/opt/xampp/logs/access_log*, yes +*/opt/xampp/logs/error.log*, yes +*/opt/xampp/logs/error_log*, yes +*/private/etc/httpd/apache2.conf*, yes +*/private/etc/httpd/apache.conf*, yes +*/private/etc/httpd/httpd.conf*, yes +*/private/etc/httpd/httpd.conf.default*, yes +*/private/etc/squirrelmail/config/config.php*, yes +*/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/jndi.properties*, yes +*/private/tmp/[JBOSS]/server/default/conf/log4j.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/login-config.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/server.log.properties*, yes +*/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/private/tmp/[JBOSS]/server/default/log/boot.log*, yes +*/private/tmp/[JBOSS]/server/default/log/server.log*, yes +*/proc/cpuinfo*, yes +*/proc/devices*, yes +*/proc/meminfo*, yes +*/proc/net/tcp*, yes +*/proc/net/udp*, yes +*/proc/self/cmdline*, yes +*/proc/self/environ*, yes +*/proc/self/mounts*, yes +*/proc/self/stat*, yes +*/proc/self/status*, yes +*/proc/version*, yes +*/Program Files/Apache Group/Apache2/conf/apache2.conf*, yes +*/Program Files/Apache Group/Apache2/conf/apache.conf*, yes +*/Program Files/Apache Group/Apache2/conf/httpd.conf*, yes +*/Program FilesApache GroupApache2confhttpd.conf*, yes +*/Program Files/Apache Group/Apache/apache2.conf*, yes +*/Program Files/Apache Group/Apache/apache.conf*, yes +*/Program Files/Apache Group/Apache/conf/apache2.conf*, yes +*/Program Files/Apache Group/Apache/conf/apache.conf*, yes +*/Program Files/Apache Group/Apache/conf/httpd.conf*, yes +*/Program FilesApache GroupApacheconfhttpd.conf*, yes +*/Program Files/Apache Group/Apache/logs/access.log*, yes +*/Program FilesApache GroupApachelogsaccess.log*, yes +*/Program Files/Apache Group/Apache/logs/error.log*, yes +*/Program FilesApache GroupApachelogserror.log*, yes +*/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/jndi.properties*, yes +*/Program Files/[JBOSS]/server/default/conf/log4j.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/login-config.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/server.log.properties*, yes +*/Program Files/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/Program Files/[JBOSS]/server/default/log/boot.log*, yes +*/Program Files/[JBOSS]/server/default/log/server.log*, yes +*/Program Files/MySQL/data/{HOST}.err*, yes +*/Program Files/MySQL/data/mysql-bin.index*, yes +*/Program Files/MySQL/data/mysql-bin.log*, yes +*/Program Files/MySQL/data/mysql.err*, yes +*/Program Files/MySQL/data/mysql.log*, yes +*/Program Files/MySQL/my.cnf*, yes +*/Program Files/MySQL/my.ini*, yes +*/Program Files/Vidalia Bundle/Polipo/polipo.conf*, yes +*/Program Files/xampp/apache/conf/apache2.conf*, yes +*/Program Files/xampp/apache/conf/apache.conf*, yes +*/Program Files/xampp/apache/conf/httpd.conf*, yes +*/Program Filesxamppapacheconfhttpd.conf*, yes +*/root/.bash_config*, yes +*/root/.bash_history*, yes +*/root/.bash_logout*, yes +*/root/.bashrc*, yes +*/root/.ksh_history*, yes +*/root/.Xauthority*, yes +*/srv/www/htdos/squirrelmail/config/config.php*, yes +*/tmp/access.log*, yes +*/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/tmp/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/tmp/[JBOSS]/server/default/conf/jndi.properties*, yes +*/tmp/[JBOSS]/server/default/conf/log4j.xml*, yes +*/tmp/[JBOSS]/server/default/conf/login-config.xml*, yes +*/tmp/[JBOSS]/server/default/conf/server.log.properties*, yes +*/tmp/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/tmp/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/tmp/[JBOSS]/server/default/log/boot.log*, yes +*/tmp/[JBOSS]/server/default/log/server.log*, yes +*/usr/apache2/conf/httpd.conf*, yes +*/usr/apache/conf/httpd.conf*, yes +*/usr/etc/pure-ftpd.conf*, yes +*/usr/home/user/lighttpd/lighttpd.conf*, yes +*/usr/home/user/var/log/apache.log*, yes +*/usr/home/user/var/log/lighttpd.error.log*, yes +*/usr/internet/pgsql/data/pg_hba.conf*, yes +*/usr/internet/pgsql/data/postmaster.log*, yes +*/usr/lib/cron/log*, yes +*/usr/lib/php.ini*, yes +*/usr/lib/php/php.ini*, yes +*/usr/lib/security/mkuser.default*, yes +*/usr/local/apache22/conf/httpd.conf*, yes +*/usr/local/apache22/httpd.conf*, yes +*/usr/local/apache2/apache2.conf*, yes +*/usr/local/apache2/apache.conf*, yes +*/usr/local/apache2/conf/apache2.conf*, yes +*/usr/local/apache2/conf/apache.conf*, yes +*/usr/local/apache2/conf/extra/httpd-ssl.conf*, yes +*/usr/local/apache2/conf/httpd.conf*, yes +*/usr/local/apache2/conf/modsec.conf*, yes +*/usr/local/apache2/conf/ssl.conf*, yes +*/usr/local/apache2/conf/vhosts.conf*, yes +*/usr/local/apache2/conf/vhosts-custom.conf*, yes +*/usr/local/apache2/httpd.conf*, yes +*/usr/local/apache2/logs/access.log*, yes +*/usr/local/apache2/logs/access_log*, yes +*/usr/local/apache2/logs/audit_log*, yes +*/usr/local/apache2/logs/error.log*, yes +*/usr/local/apache2/logs/error_log*, yes +*/usr/local/apache2/logs/lighttpd.error.log*, yes +*/usr/local/apache2/logs/lighttpd.log*, yes +*/usr/local/apache/apache2.conf*, yes +*/usr/local/apache/apache.conf*, yes +*/usr/local/apache/conf/access.conf*, yes +*/usr/local/apache/conf/apache2.conf*, yes +*/usr/local/apache/conf/apache.conf*, yes +*/usr/local/apache/conf/httpd.conf*, yes +*/usr/local/apache/conf/httpd.conf.default*, yes +*/usr/local/apache/conf/modsec.conf*, yes +*/usr/local/apache/conf/php.ini*, yes +*/usr/local/apache/conf/vhosts.conf*, yes +*/usr/local/apache/conf/vhosts-custom.conf*, yes +*/usr/local/apache/httpd.conf*, yes +*/usr/local/apache/logs/access.log*, yes +*/usr/local/apache/logs/access_log*, yes +*/usr/local/apache/logs/audit_log*, yes +*/usr/local/apache/logs/error.log*, yes +*/usr/local/apache/logs/error_log*, yes +*/usr/local/apache/logs/lighttpd.error.log*, yes +*/usr/local/apache/logs/lighttpd.log*, yes +*/usr/local/apache/logs/mod_jk.log*, yes +*/usr/local/apps/apache22/conf/httpd.conf*, yes +*/usr/local/apps/apache2/conf/httpd.conf*, yes +*/usr/local/apps/apache/conf/httpd.conf*, yes +*/usr/local/cpanel/logs*, yes +*/usr/local/cpanel/logs/access_log*, yes +*/usr/local/cpanel/logs/error_log*, yes +*/usr/local/cpanel/logs/license_log*, yes +*/usr/local/cpanel/logs/login_log*, yes +*/usr/local/cpanel/logs/stats_log*, yes +*/usr/local/etc/apache22/conf/httpd.conf*, yes +*/usr/local/etc/apache22/httpd.conf*, yes +*/usr/local/etc/apache2/conf/httpd.conf*, yes +*/usr/local/etc/apache2/httpd.conf*, yes +*/usr/local/etc/apache2/vhosts.conf*, yes +*/usr/local/etc/apache/conf/httpd.conf*, yes +*/usr/local/etc/apache/httpd.conf*, yes +*/usr/local/etc/apache/vhosts.conf*, yes +*/usr/local/etc/httpd/conf*, yes +*/usr/local/etc/httpd/conf/httpd.conf*, yes +*/usr/local/etc/lighttpd.conf*, yes +*/usr/local/etc/lighttpd.conf.new*, yes +*/usr/local/etc/nginx/nginx.conf*, yes +*/usr/local/etc/php.ini*, yes +*/usr/local/etc/pure-ftpd.conf*, yes +*/usr/local/etc/pureftpd.pdb*, yes +*/usr/local/etc/smb.conf*, yes +*/usr/local/etc/webmin/miniserv.conf*, yes +*/usr/local/etc/webmin/miniserv.users*, yes +*/usr/local/httpd/conf/httpd.conf*, yes +*/usr/local/jakarta/dist/tomcat/conf/context.xml*, yes +*/usr/local/jakarta/dist/tomcat/conf/jakarta.conf*, yes +*/usr/local/jakarta/dist/tomcat/conf/logging.properties*, yes +*/usr/local/jakarta/dist/tomcat/conf/server.xml*, yes +*/usr/local/jakarta/dist/tomcat/conf/workers.properties*, yes +*/usr/local/jakarta/dist/tomcat/logs/mod_jk.log*, yes +*/usr/local/jakarta/tomcat/conf/context.xml*, yes +*/usr/local/jakarta/tomcat/conf/jakarta.conf*, yes +*/usr/local/jakarta/tomcat/conf/logging.properties*, yes +*/usr/local/jakarta/tomcat/conf/server.xml*, yes +*/usr/local/jakarta/tomcat/conf/workers.properties*, yes +*/usr/local/jakarta/tomcat/logs/catalina.err*, yes +*/usr/local/jakarta/tomcat/logs/catalina.out*, yes +*/usr/local/jakarta/tomcat/logs/mod_jk.log*, yes +*/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/jndi.properties*, yes +*/usr/local/[JBOSS]/server/default/conf/log4j.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/login-config.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/server.log.properties*, yes +*/usr/local/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/usr/local/[JBOSS]/server/default/log/boot.log*, yes +*/usr/local/[JBOSS]/server/default/log/server.log*, yes +*/usr/local/lib/php.ini*, yes +*/usr/local/lighttpd/conf/lighttpd.conf*, yes +*/usr/local/lighttpd/log/access.log*, yes +*/usr/local/lighttpd/log/lighttpd.error.log*, yes +*/usr/local/logs/access.log*, yes +*/usr/local/logs/samba.log*, yes +*/usr/local/lsws/conf/httpd_conf.xml*, yes +*/usr/local/lsws/logs/error.log*, yes +*/usr/local/mysql/data/{HOST}.err*, yes +*/usr/local/mysql/data/mysql-bin.index*, yes +*/usr/local/mysql/data/mysql-bin.log*, yes +*/usr/local/mysql/data/mysqlderror.log*, yes +*/usr/local/mysql/data/mysql.err*, yes +*/usr/local/mysql/data/mysql.log*, yes +*/usr/local/mysql/data/mysql-slow.log*, yes +*/usr/local/nginx/conf/nginx.conf*, yes +*/usr/local/pgsql/bin/pg_passwd*, yes +*/usr/local/pgsql/data/passwd*, yes +*/usr/local/pgsql/data/pg_hba.conf*, yes +*/usr/local/pgsql/data/pg_log*, yes +*/usr/local/pgsql/data/postgresql.conf*, yes +*/usr/local/pgsql/data/postgresql.log*, yes +*/usr/local/php4/apache2.conf*, yes +*/usr/local/php4/apache2.conf.php*, yes +*/usr/local/php4/apache.conf*, yes +*/usr/local/php4/apache.conf.php*, yes +*/usr/local/php4/httpd.conf*, yes +*/usr/local/php4/httpd.conf.php*, yes +*/usr/local/php4/lib/php.ini*, yes +*/usr/local/php5/apache2.conf*, yes +*/usr/local/php5/apache2.conf.php*, yes +*/usr/local/php5/apache.conf*, yes +*/usr/local/php5/apache.conf.php*, yes +*/usr/local/php5/httpd.conf*, yes +*/usr/local/php5/httpd.conf.php*, yes +*/usr/local/php5/lib/php.ini*, yes +*/usr/local/php/apache2.conf*, yes +*/usr/local/php/apache2.conf.php*, yes +*/usr/local/php/apache.conf*, yes +*/usr/local/php/apache.conf.php*, yes +*/usr/local/php/httpd.conf*, yes +*/usr/local/php/httpd.conf.php*, yes +*/usr/local/php/lib/php.ini*, yes +*/usr/local/psa/admin/conf/php.ini*, yes +*/usr/local/psa/admin/conf/site_isolation_settings.ini*, yes +*/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php*, yes +*/usr/local/psa/admin/logs/httpsd_access_log*, yes +*/usr/local/psa/admin/logs/panel.log*, yes +*/usr/local/pureftpd/etc/pure-ftpd.conf*, yes +*/usr/local/pureftpd/etc/pureftpd.pdb*, yes +*/usr/local/pureftpd/sbin/pure-config.pl*, yes +*/usr/local/samba/lib/log.user*, yes +*/usr/local/samba/lib/smb.conf.user*, yes +*/usr/local/sb/config*, yes +*/usr/local/Zend/etc/php.ini*, yes +*/usr/local/zeus/web/global.cfg*, yes +*/usr/local/zeus/web/log/errors*, yes +*/usr/pkg/etc/httpd/httpd.conf*, yes +*/usr/pkg/etc/httpd/httpd-default.conf*, yes +*/usr/pkg/etc/httpd/httpd-vhosts.conf*, yes +*/usr/pkgsrc/net/pureftpd/*, yes +*/usr/pkgsrc/net/pureftpd/pure-ftpd.conf*, yes +*/usr/pkgsrc/net/pureftpd/pureftpd.passwd*, yes +*/usr/pkgsrc/net/pureftpd/pureftpd.pdb*, yes +*/usr/ports/contrib/pure-ftpd/*, yes +*/usr/ports/contrib/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/contrib/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/contrib/pure-ftpd/pureftpd.pdb*, yes +*/usr/ports/ftp/pure-ftpd/*, yes +*/usr/ports/ftp/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/ftp/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/ftp/pure-ftpd/pureftpd.pdb*, yes +*/usr/ports/net/pure-ftpd/*, yes +*/usr/ports/net/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/net/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/net/pure-ftpd/pureftpd.pdb*, yes +*/usr/sbin/mudlogd*, yes +*/usr/sbin/mudpasswd*, yes +*/usr/sbin/pure-config.pl*, yes +*/usr/share/adduser/adduser.conf*, yes +*/usr/share/logs/catalina.err*, yes +*/usr/share/logs/catalina.out*, yes +*/usr/share/squirrelmail/config/config.php*, yes +*/usr/share/squirrelmail/plugins/squirrel_logger/setup.php*, yes +*/usr/share/tomcat6/conf/context.xml*, yes +*/usr/share/tomcat6/conf/logging.properties*, yes +*/usr/share/tomcat6/conf/server.xml*, yes +*/usr/share/tomcat6/conf/workers.properties*, yes +*/usr/share/tomcat6/logs/catalina.err*, yes +*/usr/share/tomcat6/logs/catalina.out*, yes +*/usr/share/tomcat/logs/catalina.err*, yes +*/usr/share/tomcat/logs/catalina.out*, yes +*/usr/spool/lp/log*, yes +*/usr/spool/mqueue/syslog*, yes +*/var/adm/acct/sum/loginlog*, yes +*/var/adm/aculog*, yes +*/var/adm/aculogs*, yes +*/var/adm/crash/unix*, yes +*/var/adm/crash/vmcore*, yes +*/var/adm/cron/log*, yes +*/var/adm/dtmp*, yes +*/var/adm/lastlog/username*, yes +*/var/adm/log/asppp.log*, yes +*/var/adm/loginlog*, yes +*/var/adm/log/xferlog*, yes +*/var/adm/lp/lpd-errs*, yes +*/var/adm/messages*, yes +*/var/adm/pacct*, yes +*/var/adm/qacct*, yes +*/var/adm/ras/bootlog*, yes +*/var/adm/ras/errlog*, yes +*/var/adm/sulog*, yes +*/var/adm/SYSLOG*, yes +*/var/adm/utmp*, yes +*/var/adm/utmpx*, yes +*/var/adm/vold.log*, yes +*/var/adm/wtmp*, yes +*/var/adm/wtmpx*, yes +*/var/adm/X0msgs*, yes +*/var/apache/conf/httpd.conf*, yes +*/var/cpanel/cpanel.config*, yes +*/var/cpanel/tomcat.options*, yes +*/var/cron/log*, yes +*/var/data/mysql-bin.index*, yes +*/var/lib/mysql/my.cnf*, yes +*/var/lib/pgsql/data/postgresql.conf*, yes +*/var/lib/squirrelmail/prefs/squirrelmail.log*, yes +*/var/lighttpd.log*, yes +*/var/local/www/conf/php.ini*, yes +*/var/log/access.log*, yes +*/var/log/access_log*, yes +*/var/log/apache2/access.log*, yes +*/var/log/apache2/access_log*, yes +*/var/log/apache2/error.log*, yes +*/var/log/apache2/error_log*, yes +*/var/log/apache2/squirrelmail.err.log*, yes +*/var/log/apache2/squirrelmail.log*, yes +*/var/log/apache/access.log*, yes +*/var/log/apache/access_log*, yes +*/var/log/apache/error.log*, yes +*/var/log/apache/error_log*, yes +*/var/log/auth.log*, yes +*/var/log/authlog*, yes +*/var/log/boot.log*, yes +*/var/log/cron/var/log/postgres.log*, yes +*/var/log/daemon.log*, yes +*/var/log/daemon.log.1*, yes +*/var/log/data/mysql-bin.index*, yes +*/var/log/dmessage*, yes +*/var/log/error.log*, yes +*/var/log/error_log*, yes +*/var/log/exim/mainlog*, yes +*/var/log/exim_mainlog*, yes +*/var/log/exim/paniclog*, yes +*/var/log/exim_paniclog*, yes +*/var/log/exim/rejectlog*, yes +*/var/log/exim_rejectlog*, yes +*/var/log/ftplog*, yes +*/var/log/ftp-proxy*, yes +*/var/log/ftp-proxy/ftp-proxy.log*, yes +*/var/log/httpd-access.log*, yes +*/var/log/httpd/access.log*, yes +*/var/log/httpd/access_log*, yes +*/var/log/httpd/error.log*, yes +*/var/log/httpd/error_log*, yes +*/var/log/ipfw*, yes +*/var/log/ipfw/ipfw.log*, yes +*/var/log/ipfw.log*, yes +*/var/log/ipfw.today*, yes +*/var/log/kern.log*, yes +*/var/log/kern.log.1*, yes +*/var/log/lighttpd/*, yes +*/var/log/lighttpd.access.log*, yes +*/var/log/lighttpd/access.log*, yes +*/var/log/lighttpd/access.www.log*, yes +*/var/log/lighttpd/{DOMAIN}/access.log*, yes +*/var/log/lighttpd/{DOMAIN}/error.log*, yes +*/var/log/lighttpd.error.log*, yes +*/var/log/lighttpd/error.log*, yes +*/var/log/lighttpd/error.www.log*, yes +*/var/log/log.smb*, yes +*/var/log/mail.err*, yes +*/var/log/mail.info*, yes +*/var/log/mail.log*, yes +*/var/log/maillog*, yes +*/var/log/mail.warn*, yes +*/var/log/messages*, yes +*/var/log/messages.1*, yes +*/var/log/muddleftpd*, yes +*/var/log/muddleftpd.conf*, yes +*/var/log/mysql-bin.index*, yes +*/var/log/mysql/data/mysql-bin.index*, yes +*/var/log/mysqlderror.log*, yes +*/var/log/mysql.err*, yes +*/var/log/mysql.log*, yes +*/var/log/mysql/mysql-bin.index*, yes +*/var/log/mysql/mysql-bin.log*, yes +*/var/log/mysql/mysql.log*, yes +*/var/log/mysql/mysql-slow.log*, yes +*/var/log/news.all*, yes +*/var/log/news/news.all*, yes +*/var/log/news/news.crit*, yes +*/var/log/news/news.err*, yes +*/var/log/news/news.notice*, yes +*/var/log/news/suck.err*, yes +*/var/log/news/suck.notice*, yes +*/var/log/nginx.access_log*, yes +*/var/log/nginx/access.log*, yes +*/var/log/nginx/access_log*, yes +*/var/log/nginx.error_log*, yes +*/var/log/nginx/error.log*, yes +*/var/log/nginx/error_log*, yes +*/var/log/pgsql8.log*, yes +*/var/log/pgsql_log*, yes +*/var/log/pgsql/pgsql.log*, yes +*/var/log/pm-powersave.log*, yes +*/var/log/POPlog*, yes +*/var/log/postgres/pg_backup.log*, yes +*/var/log/postgres/postgres.log*, yes +*/var/log/postgresql.log*, yes +*/var/log/postgresql/main.log*, yes +*/var/log/postgresql/postgres.log*, yes +*/var/log/postgresql/postgresql-8.1-main.log*, yes +*/var/log/postgresql/postgresql-8.3-main.log*, yes +*/var/log/postgresql/postgresql-8.4-main.log*, yes +*/var/log/postgresql/postgresql-9.0-main.log*, yes +*/var/log/postgresql/postgresql-9.1-main.log*, yes +*/var/log/postgresql/postgresql.log*, yes +*/var/log/proftpd*, yes +*/var/log/proftpd.access_log*, yes +*/var/log/proftpd.xferlog*, yes +*/var/log/proftpd/xferlog.legacy*, yes +*/var/log/pureftpd.log*, yes +*/var/log/pure-ftpd/pure-ftpd.log*, yes +*/var/logs/access.log*, yes +*/var/log/samba.log*, yes +*/var/log/samba.log1*, yes +*/var/log/samba.log2*, yes +*/var/log/samba/log.nmbd*, yes +*/var/log/samba/log.smbd*, yes +*/var/log/squirrelmail.log*, yes +*/var/log/sso/sso.log*, yes +*/var/log/sw-cp-server/error_log*, yes +*/var/log/syslog*, yes +*/var/log/syslog.1*, yes +*/var/log/tomcat6/catalina.out*, yes +*/var/log/ufw.log*, yes +*/var/log/user.log*, yes +*/var/log/user.log.1*, yes +*/var/log/vmware/hostd-1.log*, yes +*/var/log/vmware/hostd.log*, yes +*/var/log/vsftpd.log*, yes +*/var/log/webmin/miniserv.log*, yes +*/var/log/xferlog*, yes +*/var/log/Xorg.0.log*, yes +*/var/lp/logs/lpNet*, yes +*/var/lp/logs/lpsched*, yes +*/var/lp/logs/requests*, yes +*/var/mail/root*, yes +*/var/mysql-bin.index*, yes +*/var/mysql.log*, yes +*/var/nm2/postgresql.conf*, yes +*/var/postgresql/db/postgresql.conf*, yes +*/var/postgresql/log/postgresql.log*, yes +*/var/saf/_log*, yes +*/var/saf/port/log*, yes +*/var/spool/cron/crontabs/root*, yes +*/var/spool/cron/crontabs/root*, yes +*/var/www/conf*, yes +*/var/www/conf/httpd.conf*, yes +*/var/www/html/squirrelmail/config/config.php*, yes +*/var/www/.lighttpdpassword*, yes +*/var/www/logs/access.log*, yes +*/var/www/logs/access_log*, yes +*/var/www/logs/error.log*, yes +*/var/www/logs/error_log*, yes +*/var/www/squirrelmail/config/config.php*, yes +*/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini*, yes +*/Volumes/webBackup/opt/apache2/conf/httpd.conf*, yes +*/Volumes/webBackup/private/etc/httpd/httpd.conf*, yes +*/Volumes/webBackup/private/etc/httpd/httpd.conf.default*, yes +*/wamp/bin/apache/apache2.2.21/conf/httpd.conf*, yes +*/wamp/bin/apache/apache2.2.21/logs/access.log*, yes +*/wamp/bin/apache/apache2.2.21/logs/error.log*, yes +*/wamp/bin/apache/apache2.2.21/wampserver.conf*, yes +*/wamp/bin/apache/apache2.2.22/conf/httpd.conf*, yes +*/wamp/bin/apache/apache2.2.22/conf/wampserver.conf*, yes +*/wamp/bin/apache/apache2.2.22/logs/access.log*, yes +*/wamp/bin/apache/apache2.2.22/logs/error.log*, yes +*/wamp/bin/apache/apache2.2.22/wampserver.conf*, yes +*/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index*, yes +*/wamp/bin/mysql/mysql5.5.16/my.ini*, yes +*/wamp/bin/mysql/mysql5.5.16/wampserver.conf*, yes +*/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index*, yes +*/wamp/bin/mysql/mysql5.5.24/my.ini*, yes +*/wamp/bin/mysql/mysql5.5.24/wampserver.conf*, yes +*/wamp/logs/access.log*, yes +*/wamp/logs/apache_error.log*, yes +*/wamp/logs/genquery.log*, yes +*/wamp/logs/mysql.log*, yes +*/wamp/logs/slowquery.log*, yes +*/web/conf/php.ini*, yes +*/WINDOWS/php.ini*, yes +*/WINDOWSphp.ini*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC1*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC2*, yes +*/WINDOWS/system32/logfiles/SMTPSVC*, yes +*/WINDOWS/system32/logfiles/SMTPSVC1*, yes +*/WINDOWS/system32/logfiles/SMTPSVC2*, yes +*/WINDOWS/system32/logfiles/SMTPSVC3*, yes +*/WINDOWS/system32/logfiles/SMTPSVC4*, yes +*/WINDOWS/system32/logfiles/SMTPSVC5*, yes +*/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log*, yes +*/WINNT/php.ini*, yes +*/WINNTphp.ini*, yes +*/WINNT/system32/logfiles/MSFTPSVC*, yes +*/WINNT/system32/logfiles/MSFTPSVC1*, yes +*/WINNT/system32/logfiles/MSFTPSVC2*, yes +*/WINNT/system32/logfiles/SMTPSVC*, yes +*/WINNT/system32/logfiles/SMTPSVC1*, yes +*/WINNT/system32/logfiles/SMTPSVC2*, yes +*/WINNT/system32/logfiles/SMTPSVC3*, yes +*/WINNT/system32/logfiles/SMTPSVC4*, yes +*/WINNT/system32/logfiles/SMTPSVC5*, yes +*/WINNT/system32/logfiles/W3SVC1/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC2/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC3/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC/inetsvn1.log*, yes +*/www/apache/conf/httpd.conf*, yes +*/www/conf/httpd.conf*, yes +*/www/logs/freebsddiary-access_log*, yes +*/www/logs/freebsddiary-error.log*, yes +*/www/logs/proftpd.system.log*, yes +*/xampp/apache/bin/php.ini*, yes +*/xamppapachebinphp.ini*, yes +*/xampp/apache/conf/httpd.conf*, yes +*/xampp/apache/logs/access.log*, yes +*/xampp/apache/logs/error.log*, yes +*/xampp/FileZillaFTP/FileZilla Server.xml*, yes +*/xampp/htdocs/aca.txt*, yes +*/xampp/htdocs/admin.php*, yes +*/xampp/htdocs/leer.txt*, yes +*/xampp/MercuryMail/mercury.ini*, yes +*/xampp/mysql/data/{HOST}.err*, yes +*/xampp/mysql/data/mysql-bin.index*, yes +*/xampp/mysql/data/mysql.err*, yes +*/xampp/phpMyAdmin/config.inc.php*, yes +*/xampp/php/php.ini*, yes +*/xampp/sendmail/sendmail.ini*, yes +*/xampp/sendmail/sendmail.log*, yes +*/xampp/webalizer/webalizer.conf*, yes +*/proc/self/fd/0*, yes +*/proc/self/fd/1*, yes +*/proc/self/fd/2*, yes +*/proc/self/fd/3*, yes +*/proc/self/fd/4*, yes +*/proc/self/fd/5*, yes +*/proc/self/fd/6*, yes +*/proc/self/fd/7*, yes +*/proc/self/fd/8*, yes +*/proc/self/fd/9*, yes +*/proc/self/fd/10*, yes +*/proc/self/fd/11*, yes +*/proc/self/fd/12*, yes +*/proc/self/fd/13*, yes +*/proc/self/fd/14*, yes +*/proc/self/fd/15*, yes +*/proc/self/fd/16*, yes +*/proc/self/fd/17*, yes +*/proc/self/fd/18*, yes +*/proc/self/fd/19*, yes +*/proc/self/fd/20*, yes +*/proc/self/fd/21*, yes +*/proc/self/fd/22*, yes +*/proc/self/fd/23*, yes +*/proc/self/fd/24*, yes +*/proc/self/fd/25*, yes +*/proc/self/fd/26*, yes +*/proc/self/fd/27*, yes +*/proc/self/fd/28*, yes +*/proc/self/fd/29*, yes +*/proc/self/fd/30*, yes +*/proc/self/fd/31*, yes +*/proc/self/fd/32*, yes +*/proc/self/fd/33*, yes +*/proc/self/fd/34*, yes +*/proc/self/fd/35*, yes +*/proc/self/fd/36*, yes +*/proc/self/fd/37*, yes +*/proc/self/fd/38*, yes +*/proc/self/fd/39*, yes +*/proc/self/fd/40*, yes +*/proc/self/fd/41*, yes +*/proc/self/fd/42*, yes +*/proc/self/fd/43*, yes +*/proc/self/fd/44*, yes +*/proc/self/fd/45*, yes +*/proc/self/fd/46*, yes +*/proc/self/fd/47*, yes +*/proc/self/fd/48*, yes +*/proc/self/fd/49*, yes +*/proc/self/fd/50*, yes +*/proc/self/fd/51*, yes +*/proc/self/fd/52*, yes +*/proc/self/fd/53*, yes +*/proc/self/fd/54*, yes +*/proc/self/fd/55*, yes +*/proc/self/fd/56*, yes +*/proc/self/fd/57*, yes +*/proc/self/fd/58*, yes +*/proc/self/fd/59*, yes +*/proc/self/fd/60*, yes +*/proc/self/fd/61*, yes +*/proc/self/fd/62*, yes +*/proc/self/fd/63*, yes +*/proc/self/fd/64*, yes +*/proc/self/fd/65*, yes +*/proc/self/fd/66*, yes +*/proc/self/fd/67*, yes +*/proc/self/fd/68*, yes +*/proc/self/fd/69*, yes +*/proc/self/fd/70*, yes +*/proc/self/fd/71*, yes +*/proc/self/fd/72*, yes +*/proc/self/fd/73*, yes +*/proc/self/fd/74*, yes +*/proc/self/fd/75*, yes +*/proc/self/fd/76*, yes +*/proc/self/fd/77*, yes +*/proc/self/fd/78*, yes +*/proc/self/fd/79*, yes +*/proc/self/fd/80*, yes +*/proc/self/fd/81*, yes +*/proc/self/fd/82*, yes +*/proc/self/fd/83*, yes +*/proc/self/fd/84*, yes +*/proc/self/fd/85*, yes +*/proc/self/fd/86*, yes +*/proc/self/fd/87*, yes +*/proc/self/fd/88*, yes +*/proc/self/fd/89*, yes +*/proc/self/fd/90*, yes +*/proc/self/fd/91*, yes +*/proc/self/fd/92*, yes +*/proc/self/fd/93*, yes +*/proc/self/fd/94*, yes +*/proc/self/fd/95*, yes +*/proc/self/fd/96*, yes +*/proc/self/fd/97*, yes +*/proc/self/fd/98*, yes +*/proc/self/fd/99*, yes +*/proc/self/fd/100*, yes \ No newline at end of file From ccede9d326d0467b1344619c9fe132d7e878d057 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:13:53 +0200 Subject: [PATCH 10/70] dev_sec2 --- ...ail_suspicious_subject_with_attachment.yml | 1 + .../gsuite_suspicious_shared_file_name.yml | 69 +++++++++++++++++++ ...suite_suspicious_shared_file_name.test.yml | 12 ++++ 3 files changed, 82 insertions(+) create mode 100644 detections/endpoint/gsuite_suspicious_shared_file_name.yml create mode 100644 tests/endpoint/gsuite_suspicious_shared_file_name.test.yml diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml index 99ca5cfd98..566f03c8a9 100644 --- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml @@ -31,6 +31,7 @@ known_false_positives: normal user or normal transaction may contain the subject this detection try to search. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - DevSecOps diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml new file mode 100644 index 0000000000..f078dbcbeb --- /dev/null +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -0,0 +1,69 @@ +name: Gsuite Suspicious Shared File Name +id: 07eed200-03f5-11ec-98fb-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +- Email +description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. + This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. + This detection can also catch some normal email communication between organization and its external customer. +search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") + | rex field=parameters.owner "[^@]+@(?[^@]+)" + | rex field=parameters.target_user "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_suspicious_shared_file_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal user or normal transaction may contain the subject and file type attachment that + this detection try to search +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - parameters.doc_title + - src_domain + - dest_domain + - email + - parameters.visibility + - parameters.owner + - parameters.doc_type + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ + observable: + - name: parameters.owner + type: User + role: + - attacker + - name: email + type: User + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml new file mode 100644 index 0000000000..a59374a794 --- /dev/null +++ b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Suspicious Shared File Name Unit Test +tests: +- name: Gsuite Suspicious Shared File Name + file: endpoint/gsuite_suspicious_shared_file_name.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gdrive_susp_attach.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log + source: http:gsuite + sourcetype: gsuite:drive:json \ No newline at end of file From e16bc9a3b8b944f33355b43094b452b96bd5056e Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:16:30 +0200 Subject: [PATCH 11/70] dev_sec2 --- detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml index f078dbcbeb..87f2ecbb87 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -3,7 +3,7 @@ id: 07eed200-03f5-11ec-98fb-acde48001122 version: 1 date: '2021-08-23' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint - Email From 1e95e7a0e1afc0b996783f51802cabc5fa40cf43 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:18:57 +0200 Subject: [PATCH 12/70] dev_sec2 --- detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml index 87f2ecbb87..dda923e569 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -10,7 +10,7 @@ datamodel: description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") +search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" From 5c44142de49e2b6bed6ed786221891484d519d66 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 13:50:44 +0200 Subject: [PATCH 13/70] k8s detection --- detections/cloud/kubernetes_nginx_ingress_lfi.yml | 11 ++++++++--- tests/cloud/kubernetes_nginx_ingress_lfi.test.yml | 12 ++++++++++++ 2 files changed, 20 insertions(+), 3 deletions(-) create mode 100644 tests/cloud/kubernetes_nginx_ingress_lfi.test.yml diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index fe48abd74d..9525617869 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -7,9 +7,14 @@ type: TTP datamodel: [] description: This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks. -search: '`kubernetes_container_controller` +search: 'kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" - | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT local_file_inclusion_paths + | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path + | search lfi_path=yes + | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy + | rex field=request "^(?\S+)\s(?\S+)\s" + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown @@ -26,7 +31,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: Local File Inclusion Attack detected on + message: Local File Inclusion Attack detected on $host$ mitre_attack_id: - T1212 nist: diff --git a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml new file mode 100644 index 0000000000..941c06c5a6 --- /dev/null +++ b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Nginx Ingress LFI Unit Test +tests: +- name: Kubernetes Nginx Ingress LFI + file: cloud/kubernetes_nginx_ingress_lfi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: kuberntest_nginx_lfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_lfi_attack/kuberntest_nginx_lfi_attack.log + sourcetype: kube:container:controller + source: kubernetess From d6237603f5c0ad8a3f3e90995bdef1ccec5b2089 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 14:15:26 +0200 Subject: [PATCH 14/70] k8s detection --- detections/cloud/kubernetes_nginx_ingress_lfi.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 9525617869..7402e66d0c 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks. -search: 'kubernetes_container_controller` +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes From fdcb689569ab4747c7ed00fe67c18085be169cf2 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 15:01:21 +0200 Subject: [PATCH 15/70] k8s detection --- tests/cloud/kubernetes_nginx_ingress_lfi.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml index 941c06c5a6..4bf2c48447 100644 --- a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml +++ b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml @@ -3,7 +3,7 @@ tests: - name: Kubernetes Nginx Ingress LFI file: cloud/kubernetes_nginx_ingress_lfi.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-7d' + earliest_time: '-365d' latest_time: 'now' attack_data: - file_name: kuberntest_nginx_lfi_attack.log From bd5fa2644245d5585f9e465f6e26969383ee564e Mon Sep 17 00:00:00 2001 From: root Date: Mon, 23 Aug 2021 14:49:01 +0000 Subject: [PATCH 16/70] Added detection testing service results inKubernetes Nginx Ingress LFI --- .../cloud/kubernetes_nginx_ingress_lfi.yml | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 7402e66d0c..3bdd0174e4 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -5,17 +5,15 @@ date: '2021-08-20' author: Patrick Bareiss, Splunk type: TTP datamodel: [] -description: This search uses the Kubernetes logs from a nginx ingress controller to - detect local file inclusion attacks. -search: '`kubernetes_container_controller` - | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" - | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path - | search lfi_path=yes - | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy - | rex field=request "^(?\S+)\s(?\S+)\s" - | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `kubernetes_nginx_ingress_lfi_filter`' +description: This search uses the Kubernetes logs from a nginx ingress controller + to detect local file inclusion attacks. +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT + lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as + status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, + url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown references: @@ -51,3 +49,6 @@ tags: - raw risk_score: 49 security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_lfi_attack/kuberntest_nginx_lfi_attack.log From 0ab169917abbf50329f8873824d573ae5d0f4fdb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 17:11:51 +0200 Subject: [PATCH 17/70] new detection rfi k8s --- .../cloud/kubernetes_nginx_ingress_rfi.yml | 53 +++++++++++++++++++ .../kubernetes_nginx_ingress_lfi.test.yml | 4 +- .../kubernetes_nginx_ingress_rfi.test.yml | 12 +++++ 3 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/kubernetes_nginx_ingress_rfi.yml create mode 100644 tests/cloud/kubernetes_nginx_ingress_rfi.test.yml diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml new file mode 100644 index 0000000000..480d3fea46 --- /dev/null +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -0,0 +1,53 @@ +name: Kubernetes Nginx Ingress RFI +id: fc5531ae-62fd-4de6-9c36-b4afdae8ca95 +version: 1 +date: '2021-08-23' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from a nginx ingress controller + to detect remote file inclusion attacks. +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | rex field=request "^(?\S+)?\s(?\S+)\s" + | rex field=url "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" + | search dest_ip=* + | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `kubernetes_nginx_ingress_rfi_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +- https://www.netsparker.com/blog/web-security/remote-file-inclusion-vulnerability/ +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Remote File Inclusion Attack detected on $host$ + mitre_attack_id: + - T1212 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - raw + risk_score: 49 + security_domain: network + \ No newline at end of file diff --git a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml index 4bf2c48447..df40b9000d 100644 --- a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml +++ b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-365d' latest_time: 'now' attack_data: - - file_name: kuberntest_nginx_lfi_attack.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_lfi_attack/kuberntest_nginx_lfi_attack.log + - file_name: kubernetes_nginx_lfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log sourcetype: kube:container:controller source: kubernetess diff --git a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml new file mode 100644 index 0000000000..b04a5f5da8 --- /dev/null +++ b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Nginx Ingress RFI Unit Test +tests: +- name: Kubernetes Nginx Ingress RFI + file: cloud/kubernetes_nginx_ingress_rfi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_nginx_rfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + sourcetype: kube:container:controller + source: kubernetess From 7c8f1416b62cda9ad8f8f315f853d11d0ed58a07 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 17:30:20 +0200 Subject: [PATCH 18/70] dev_sec2 --- .../gsuite_email_suspicious_subject_with_attachment.yml | 5 +---- .../gsuite_suspicious_shared_file_name.yml | 4 +--- .../gsuite_email_suspicious_subject_with_attachment.test.yml | 2 +- .../gsuite_suspicious_shared_file_name.test.yml | 2 +- 4 files changed, 4 insertions(+), 9 deletions(-) rename detections/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.yml (98%) rename detections/{endpoint => cloud}/gsuite_suspicious_shared_file_name.yml (98%) rename tests/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.test.yml (87%) rename tests/{endpoint => cloud}/gsuite_suspicious_shared_file_name.test.yml (89%) diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml similarity index 98% rename from detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml rename to detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index 566f03c8a9..cba0a58be3 100644 --- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -4,10 +4,7 @@ version: 1 date: '2021-08-19' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -- Email -- Updates +datamodel: [] description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml similarity index 98% rename from detections/endpoint/gsuite_suspicious_shared_file_name.yml rename to detections/cloud/gsuite_suspicious_shared_file_name.yml index dda923e569..9b7bd30b24 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -4,9 +4,7 @@ version: 1 date: '2021-08-23' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -- Email +datamodel: [] description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml similarity index 87% rename from tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml rename to tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml index c3cb0a32c8..bd6e1a260c 100644 --- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml +++ b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -1,7 +1,7 @@ name: Gsuite Email Suspicious Subject With Attachment Unit Test tests: - name: Gsuite Email Suspicious Subject With Attachment - file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml + file: cloud/gsuite_email_suspicious_subject_with_attachment.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml similarity index 89% rename from tests/endpoint/gsuite_suspicious_shared_file_name.test.yml rename to tests/cloud/gsuite_suspicious_shared_file_name.test.yml index a59374a794..70297baf7d 100644 --- a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml +++ b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml @@ -1,7 +1,7 @@ name: Gsuite Suspicious Shared File Name Unit Test tests: - name: Gsuite Suspicious Shared File Name - file: endpoint/gsuite_suspicious_shared_file_name.yml + file: cloud/gsuite_suspicious_shared_file_name.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 211775854f4f562ed3a495ad88427bbf7084763f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 18:42:24 +0200 Subject: [PATCH 19/70] dev_sec2 --- ...mail_with_known_abuse_web_service_link.yml | 57 +++++++++++++++++++ ...with_known_abuse_web_service_link.test.yml | 12 ++++ 2 files changed, 69 insertions(+) create mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml create mode 100644 tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml new file mode 100644 index 0000000000..9c9e04c81b --- /dev/null +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -0,0 +1,57 @@ +name: Gsuite Email With Known Abuse Web Service Link +id: 8630aa22-042b-11ec-af39-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: [] +description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. + This event can encounter some normal email traffic within organization and external email that normally using this application and services. +search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") +| rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_with_known_abuse_web_service_link_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection. +references: +- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim + \ No newline at end of file diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml new file mode 100644 index 0000000000..d8161f3f21 --- /dev/null +++ b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Email With Known Abuse Web Service Link Unit Test +tests: +- name: Gsuite Email With Known Abuse Web Service Link + file: cloud/gsuite_email_with_known_abuse_web_service_link.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gsuite_susp_url.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file From d831d8b84ae2f0a9cf454b0fbefdd684732a6a6e Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 18:44:45 +0200 Subject: [PATCH 20/70] dev_sec2 --- .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index 9c9e04c81b..c1c4f72ba8 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -3,7 +3,7 @@ id: 8630aa22-042b-11ec-af39-acde48001122 version: 1 date: '2021-08-23' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: [] description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. From dd2efaad4369fcd79585dcda390d4ef06732c752 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 23 Aug 2021 16:47:15 +0000 Subject: [PATCH 21/70] Added detection testing service results inKubernetes Nginx Ingress LFI --- detections/cloud/kubernetes_nginx_ingress_lfi.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 3bdd0174e4..b91a2780ab 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -51,4 +51,4 @@ tags: security_domain: network automated_detection_testing: passed dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_lfi_attack/kuberntest_nginx_lfi_attack.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log From 7804f96d6750d7b778c7499f9041f7589051f6da Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 18:52:55 +0200 Subject: [PATCH 22/70] dev_git --- .../{endpoint => cloud}/github_commit_changes_in_master.yml | 3 +-- .../github_commit_changes_in_master.test.yml | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) rename detections/{endpoint => cloud}/github_commit_changes_in_master.yml (98%) rename tests/{endpoint => cloud}/github_commit_changes_in_master.test.yml (89%) diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml similarity index 98% rename from detections/endpoint/github_commit_changes_in_master.yml rename to detections/cloud/github_commit_changes_in_master.yml index 86bf3bfb84..73636df24e 100644 --- a/detections/endpoint/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-20' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch diff --git a/tests/endpoint/github_commit_changes_in_master.test.yml b/tests/cloud/github_commit_changes_in_master.test.yml similarity index 89% rename from tests/endpoint/github_commit_changes_in_master.test.yml rename to tests/cloud/github_commit_changes_in_master.test.yml index 0c1039d1b2..7c0ea5df89 100644 --- a/tests/endpoint/github_commit_changes_in_master.test.yml +++ b/tests/cloud/github_commit_changes_in_master.test.yml @@ -1,7 +1,7 @@ name: Github Commit Changes In Master Unit Test tests: - name: Github Commit Changes In Master - file: endpoint/github_commit_changes_in_master.yml + file: cloud/github_commit_changes_in_master.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 1d5578b8700219d3ae06bf297b61e01a29d91f0d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Aug 2021 19:39:23 +0200 Subject: [PATCH 23/70] new detection rfi k8s --- tests/cloud/kubernetes_nginx_ingress_rfi.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml index b04a5f5da8..86ca2b5c27 100644 --- a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml +++ b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: kubernetes_nginx_rfi_attack.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log sourcetype: kube:container:controller source: kubernetess From 5802a743d35b26c3cbfabe6854fc69a64a2df1b9 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 23 Aug 2021 17:56:31 +0000 Subject: [PATCH 24/70] Added detection testing service results inKubernetes Nginx Ingress RFI --- .../cloud/kubernetes_nginx_ingress_rfi.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml index 480d3fea46..04e9c21fff 100644 --- a/detections/cloud/kubernetes_nginx_ingress_rfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -8,13 +8,11 @@ datamodel: [] description: This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks. search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" - | rex field=request "^(?\S+)?\s(?\S+)\s" - | rex field=url "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" - | search dest_ip=* - | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy - | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `kubernetes_nginx_ingress_rfi_filter`' + | rex field=request "^(?\S+)?\s(?\S+)\s" | rex field=url "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" + | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name + as proxy | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, + dest_ip status, url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown references: @@ -50,4 +48,6 @@ tags: - raw risk_score: 49 security_domain: network - \ No newline at end of file + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log From 0cafcd4f87d8b3cfba96c53bde5a4bd0e0906821 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 20:06:39 +0200 Subject: [PATCH 25/70] dev_sec2 --- ...mail_with_known_abuse_web_service_link.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml new file mode 100644 index 0000000000..440dbbf50b --- /dev/null +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -0,0 +1,57 @@ +name: Gsuite Email With Known Abuse Web Service Link +id: 8630aa22-042b-11ec-af39-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] +description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. + This event can encounter some normal email traffic within organization and external email that normally using this application and services. +search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") +| rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_with_known_abuse_web_service_link_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection. +references: +- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim + \ No newline at end of file From 90850700d2065bc05ab0b97aa757d7073b9c845b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 20:08:35 +0200 Subject: [PATCH 26/70] dev_sec2 --- .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index c1c4f72ba8..440dbbf50b 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -11,7 +11,7 @@ search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*tel | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address + |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter`' From 3aad8766c29adceb8d8b6fd00dfa9262338285ce Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 09:58:47 +0200 Subject: [PATCH 27/70] new detection rfi k8s --- tests/cloud/kubernetes_nginx_ingress_lfi.test.yml | 2 +- tests/cloud/kubernetes_nginx_ingress_rfi.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml index df40b9000d..756ad99e29 100644 --- a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml +++ b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml @@ -9,4 +9,4 @@ tests: - file_name: kubernetes_nginx_lfi_attack.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log sourcetype: kube:container:controller - source: kubernetess + source: kubernetes diff --git a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml index 86ca2b5c27..792162624c 100644 --- a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml +++ b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml @@ -9,4 +9,4 @@ tests: - file_name: kubernetes_nginx_rfi_attack.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log sourcetype: kube:container:controller - source: kubernetess + source: kubernetes From 53bf23562239f1545d504200ca701961b051e223 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 14:39:15 +0200 Subject: [PATCH 28/70] k8s scanner detection --- .../kubernetes_scanner_image_pulling.yml | 54 +++++++++++++++++++ macros/kube_objects_events.yml | 4 ++ .../kubernetes_scanner_image_pulling.test.yml | 12 +++++ 3 files changed, 70 insertions(+) create mode 100644 detections/cloud/kubernetes_scanner_image_pulling.yml create mode 100644 macros/kube_objects_events.yml create mode 100644 tests/cloud/kubernetes_scanner_image_pulling.test.yml diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml new file mode 100644 index 0000000000..b998722475 --- /dev/null +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -0,0 +1,54 @@ +name: Kubernetes Scanner Image Pulling +id: 4890cd6b-0112-4974-a272-c5c153aee551 +version: 1 +date: '2021-08-24' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to + detect Kubernetes Security Scanner. +search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") + | rename object.* AS * + | rename involvedObject.* AS * + | rename source.host AS host + | stats min(_time) as firstTime max(_time) as lastTime count by host, cluster_name, name, namespace, kind, reason, message + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `kubernetes_scanner_image_pulling_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Kubernetes Scanner image pulled on host $host$ + mitre_attack_id: + - T1526 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: host + type: Entity + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - object.message + - source.host + - object.involvedObject.name + - object.involvedObject.namespace + - object.involvedObject.kind + - object.message + - object.reason + risk_score: 49 + security_domain: network diff --git a/macros/kube_objects_events.yml b/macros/kube_objects_events.yml new file mode 100644 index 0000000000..be9ca1b2c7 --- /dev/null +++ b/macros/kube_objects_events.yml @@ -0,0 +1,4 @@ +definition: sourcetype="kube:objects:events" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: kube_objects_events diff --git a/tests/cloud/kubernetes_scanner_image_pulling.test.yml b/tests/cloud/kubernetes_scanner_image_pulling.test.yml new file mode 100644 index 0000000000..a96914f719 --- /dev/null +++ b/tests/cloud/kubernetes_scanner_image_pulling.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Scanner Image Pulling Unit Test +tests: +- name: Kubernetes Scanner Image Pulling + file: cloud/kubernetes_scanner_image_pulling + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_kube_hunter.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json + sourcetype: kube:objects:events + source: kubernetes From 080eae88ef89dd6c88a0521bcaeae121c22f307b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 14:48:31 +0200 Subject: [PATCH 29/70] k8s scanner detection --- tests/cloud/kubernetes_scanner_image_pulling.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/kubernetes_scanner_image_pulling.test.yml b/tests/cloud/kubernetes_scanner_image_pulling.test.yml index a96914f719..5d8b50443a 100644 --- a/tests/cloud/kubernetes_scanner_image_pulling.test.yml +++ b/tests/cloud/kubernetes_scanner_image_pulling.test.yml @@ -1,7 +1,7 @@ name: Kubernetes Scanner Image Pulling Unit Test tests: - name: Kubernetes Scanner Image Pulling - file: cloud/kubernetes_scanner_image_pulling + file: cloud/kubernetes_scanner_image_pulling.yml pass_condition: '| stats count | where count > 0' earliest_time: '-7d' latest_time: 'now' From 728f647b264fb7ca31148438e517786b4857eb7d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 16:34:48 +0200 Subject: [PATCH 30/70] k8s scanner --- detections/cloud/kubernetes_scanner_image_pulling.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b998722475..cab480da83 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -11,7 +11,7 @@ search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host - | stats min(_time) as firstTime max(_time) as lastTime count by host, cluster_name, name, namespace, kind, reason, message + | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. From 6b4f6a60cebdd28827ddf175a153910fe7e9acdb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 09:55:42 +0200 Subject: [PATCH 31/70] k8s scanner --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index cab480da83..b3229a8415 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -52,3 +52,4 @@ tags: - object.reason risk_score: 49 security_domain: network + From fed6fc95024f1aea2f5e322b695a78975b5d6727 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 10:49:51 +0200 Subject: [PATCH 32/70] k8s scanner --- macros/kube_objects_events.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/kube_objects_events.yml b/macros/kube_objects_events.yml index be9ca1b2c7..ae4dd70960 100644 --- a/macros/kube_objects_events.yml +++ b/macros/kube_objects_events.yml @@ -1,4 +1,4 @@ -definition: sourcetype="kube:objects:events" +definition: sourcetype=kube:objects:events description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: kube_objects_events From cfa735bde414b4c8536113faf2b8999887ebdbb3 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 25 Aug 2021 09:10:24 +0000 Subject: [PATCH 33/70] Added detection testing service results inKubernetes Scanner Image Pulling --- .../kubernetes_scanner_image_pulling.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b3229a8415..5346d484af 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -5,14 +5,13 @@ date: '2021-08-24' author: Patrick Bareiss, Splunk type: TTP datamodel: [] -description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to - detect Kubernetes Security Scanner. -search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") - | rename object.* AS * - | rename involvedObject.* AS * - | rename source.host AS host - | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes + to detect Kubernetes Security Scanner. +search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling + image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") + | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host + | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, + kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown @@ -52,4 +51,6 @@ tags: - object.reason risk_score: 49 security_domain: network - + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json From 38e69f6dab3c6d97fe4154cec0703f55c7c1b80e Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 17:08:47 +0200 Subject: [PATCH 34/70] k8s scanner --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b3229a8415..cab480da83 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -52,4 +52,3 @@ tags: - object.reason risk_score: 49 security_domain: network - From 2a96487a8a8a4d85328e85dbf6f4d3ccb3751f16 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 17:12:21 +0200 Subject: [PATCH 35/70] small change --- detections/cloud/kubernetes_nginx_ingress_rfi.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml index 04e9c21fff..9255efa4dc 100644 --- a/detections/cloud/kubernetes_nginx_ingress_rfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -51,3 +51,4 @@ tags: automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + From 710609b4d6d5c9fe0b76a09224371322f9077e2c Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Aug 2021 12:23:47 +0200 Subject: [PATCH 36/70] dev_sec2 --- .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index 440dbbf50b..cf0bf78c3a 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -5,7 +5,7 @@ date: '2021-08-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. +description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") | rex field=source.from_header_address "[^@]+@(?[^@]+)" From 000e3ff036e595e36aed0650653a4fbaa609f979 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 11:14:39 -0700 Subject: [PATCH 37/70] Split validate-and-build into two separate files. Changed detection-testing to run on each commit instead of only tag. Detection testing also runs on current branch, not just develop. --- .github/workflows/detection-testing.yml | 2 +- .github/workflows/validate-and-build.yml | 342 +---------------------- 2 files changed, 3 insertions(+), 341 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 73136663ab..c7dd81d847 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -31,7 +31,7 @@ jobs: environment: Detection-Testing-Approval needs: [validate-tag-if-present] #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') + if: startsWith(github.ref, 'refs/heads/') steps: - name: Checkout Repo diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml index 24f1059da0..54767b940c 100644 --- a/.github/workflows/validate-and-build.yml +++ b/.github/workflows/validate-and-build.yml @@ -37,7 +37,7 @@ jobs: else echo "PASS: Not a tagged release" exit 0 - fi + fi validate-content: #Note that the CircleCI job used a Container. The way to do this with Github Actions @@ -263,342 +263,4 @@ jobs: path: | build/DA-ESS-ContentUpdate-latest.tar.gz build/DA-ESS_AmazonWebServices_Content-latest.tar.gz - build/checksum.txt - - - run-appinspect: - runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package] - #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') - steps: - - - name: Checkout Repo - uses: actions/checkout@v2 - with: - ref: 'develop' - - #Download the artifacts we want to check - - name: Restore Content-Pack Artifacts for AppInspect testing - uses: actions/download-artifact@v2 - with: - name: content-latest - path: build/ - - - - - name: Install System Packages - run: | - sudo apt update -qq - sudo apt install jq -qq - - - - - name: Submit ESCU Package to AppInspect API - env: - APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} - APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }} - run: | - cd bin - #Enclose in quotes in case there are any special characters in the username/password - #Better not to pass these arguments on the command line, if possible - ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" - - - name: Submit SAAWS Package to AppInspect API - env: - APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} - APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }} - run: | - cd bin - ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" - - - name: Create report artifact - if: always() - run: | - #Always create this, regardless of whether success or failure above - tar -cvzf report.tar.gz report/ - - - name: store_artifacts - uses: actions/upload-artifact@v2 - with: - name: appinspect_reports - path: | - report.tar.gz - - #Still store the report, even if we have failed (otherwise we don't know why/how we failed) - - name: store_artifacts_on_failure - uses: actions/upload-artifact@v2 - if: failure() - with: - name: appinspect_reports_failure - path: | - report.tar.gz - - create-report: - runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect] - #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') - steps: - - name: Checkout Repo - uses: actions/checkout@v2 - with: - ref: 'develop' - - - - name: Install System Packages - run: | - sudo apt update -qq - sudo apt install jq -qq - - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - name: Install Python Dependencies - run: | - #Get the virtualenv set up - rm -rf venv - python3 -m venv --clear venv - source venv/bin/activate - python3 -m pip install -q -r requirements.txt - - - name: run reporting - run: | - source venv/bin/activate - python3 bin/reporting.py - - #Official, Verified Amazon-AWS Github Account Provided Action - - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - - - name: Upload Reporting - run: | - aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg" - - update-sources-github: - runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report] - #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') - steps: - - - name: Checkout Repo - uses: actions/checkout@v2 - with: - ref: 'develop' - - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - - uses: actions/download-artifact@v2 - with: - name: content-latest - - - name: Stage artifacts in proper directories - run: | - mkdir latest-escu - tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1 - mkdir latest-saaws - tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1 - - name: Install Python Dependencies - run: | - #Get the virtualenv set up - rm -rf venv - python3 -m venv --clear venv - source venv/bin/activate - python3 -m pip install -q -r requirements.txt - - - name: Get CTI Repo for Mitre context - uses: actions/checkout@v2 - with: - repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD - path: "cti/" - - - name: Get branch and PR required for detection testing main.py - id: vars - run: | - echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Run doc-gen - run: | - source venv/bin/activate - python3 bin/doc_gen.py --path . --output docs -v - - - name: Make YAMLs Pretty - run: | - source venv/bin/activate - python3 bin/pretty_yaml.py --path . -v - - - name: Run generate-actors-map - run: | - source venv/bin/activate - python3 bin/generate-actors-map.py --projects_path . --output docs/mitre-map/ - - - name: Run generate-coverage-map - run: | - source venv/bin/activate - python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map - - - name: Update github with new docs and package bits - run: | - rm -rf dist - mkdir dist - echo "Directory layout 3" - pwd - ls -lah - mv latest-escu dist/escu - mv latest-saaws dist/saaws - # configure git to prep for commit - #git config credential.helper 'cache --timeout=120' - git config user.email "research@splunk.com" - git config user.name "research bot" - git config --global push.default simple - git add dist/* - git add docs/* - git add detections/* - git commit --allow-empty -m "updating docs and package bits [ci skip]" - # Push quietly to prevent showing the token in log - #No need to provide any credentials - git push - - - publish-github-release: - #Github-maintained release action is in archived state: https://github.com/actions/create-release - #They recommend several and we use the following with the most stars: https://github.com/softprops/action-gh-release - runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github] - #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') - steps: - - #Get the artifacts that we need - - uses: actions/download-artifact@v2 - with: - name: content-latest - - uses: actions/download-artifact@v2 - with: - name: appinspect_reports - - #Rename those artifacts appropriately - - name: Set tag - id: vars - run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}" - - - name: Rename the content-update appropriately - run: | - cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz - cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz - - #No checksum on the reports - cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz - - cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt - - #Upload all of the artifacts that we have created using the third party - #action recommended bu Github - - name: Upload Release Artifacts - uses: softprops/action-gh-release@v1 - with: - files: | - DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz - DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz - report-${{ steps.vars.outputs.tag }}.tar.gz - checksum-${{ steps.vars.outputs.tag }}.txt - - - - attack-range-update: - runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release] - #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') - steps: - - - uses: actions/download-artifact@v2 - with: - name: content-latest - - #Official, Verified Amazon-AWS Github Account Provided Action - - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - - - name: Sync latest ESCU to the Attack Range S3 bucket for apps - run: | - aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/ - # make the file public since it is not by default - aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read - - master-api-update: - runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] - #Only run when tagged - if: startsWith(github.ref, 'refs/tags/v') - steps: - - name: Checkout Repo - uses: actions/checkout@v2 - with: - ref: 'develop' - - - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - name: Install Python Dependencies - run: | - #Get the virtualenv set up - rm -rf venv - python3 -m venv --clear venv - source venv/bin/activate - python3 -m pip install -q -r requirements.txt - - - name: Create Baseline Folder - run: | - source venv/bin/activate - python3 bin/create_baseline_folder.py - - #Official, Verified Amazon-AWS Github Account Provided Action - - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - - - name: Update API sources - run: | - aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml" - aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml" - aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml" - aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml" - aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml" - aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv" - aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml" - aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml" - - name: Security Content API Smoke Test - run: | - API_URL='https://content.splunkresearch.com/detections' - API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" $API_URL) - echo "Security Content API Status: $API_STATUS" - if [ "$API_STATUS" != "200" ]; then - echo "Error [Security Content API status: $API_STATUS]" - exit 1 - fi - - + build/checksum.txt \ No newline at end of file From 7365c7c5a93a922a2c88a7c900e0999e220afa3b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 11:15:46 -0700 Subject: [PATCH 38/70] Checks that happen on release (like appinspect and updating S3) --- .github/workflows/release-checks.yml | 360 +++++++++++++++++++++++++++ 1 file changed, 360 insertions(+) create mode 100644 .github/workflows/release-checks.yml diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml new file mode 100644 index 0000000000..94e167ab6c --- /dev/null +++ b/.github/workflows/release-checks.yml @@ -0,0 +1,360 @@ +name: release-checks +on: + workflow_run: + workflows: ["validate-and-build"] + branches: ["develop"] + types: + - completed + + +jobs: + run-appinspect: + runs-on: ubuntu-latest + needs: [validate-content, build-sources, build-package] + #Only run when tagged + if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: + + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + #Download the artifacts we want to check + - name: Restore Content-Pack Artifacts for AppInspect testing + uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + name: content-latest + path: build/ + + + + - name: Install System Packages + run: | + sudo apt update -qq + sudo apt install jq -qq + + + + - name: Submit ESCU Package to AppInspect API + env: + APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} + APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }} + run: | + cd bin + #Enclose in quotes in case there are any special characters in the username/password + #Better not to pass these arguments on the command line, if possible + ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" + + - name: Submit SAAWS Package to AppInspect API + env: + APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} + APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }} + run: | + cd bin + ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" + + - name: Create report artifact + if: always() + run: | + #Always create this, regardless of whether success or failure above + tar -cvzf report.tar.gz report/ + + - name: store_artifacts + uses: actions/upload-artifact@v2 + with: + name: appinspect_reports + path: | + report.tar.gz + + #Still store the report, even if we have failed (otherwise we don't know why/how we failed) + - name: store_artifacts_on_failure + uses: actions/upload-artifact@v2 + if: failure() + with: + name: appinspect_reports_failure + path: | + report.tar.gz + + create-report: + runs-on: ubuntu-latest + needs: [validate-content, build-sources, build-package, run-appinspect] + #Only run when tagged + if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + + - name: Install System Packages + run: | + sudo apt update -qq + sudo apt install jq -qq + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: run reporting + run: | + source venv/bin/activate + python3 bin/reporting.py + + #Official, Verified Amazon-AWS Github Account Provided Action + - uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + + - name: Upload Reporting + run: | + aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg" + + update-sources-github: + runs-on: ubuntu-latest + needs: [validate-content, build-sources, build-package, run-appinspect, create-report] + #Only run when tagged + if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: + + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + path: . + name: content-latest + + - name: Stage artifacts in proper directories + run: | + mkdir latest-escu + tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1 + mkdir latest-saaws + tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1 + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 + with: + repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD + path: "cti/" + + - name: Get branch and PR required for detection testing main.py + id: vars + run: | + echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" + + - name: Run doc-gen + run: | + source venv/bin/activate + python3 bin/doc_gen.py --path . --output docs -v + + - name: Make YAMLs Pretty + run: | + source venv/bin/activate + python3 bin/pretty_yaml.py --path . -v + + - name: Run generate-actors-map + run: | + source venv/bin/activate + python3 bin/generate-actors-map.py --projects_path . --output docs/mitre-map/ + + - name: Run generate-coverage-map + run: | + source venv/bin/activate + python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map + + - name: Update github with new docs and package bits + run: | + rm -rf dist + mkdir dist + echo "Directory layout 3" + pwd + ls -lah + mv latest-escu dist/escu + mv latest-saaws dist/saaws + # configure git to prep for commit + #git config credential.helper 'cache --timeout=120' + git config user.email "research@splunk.com" + git config user.name "research bot" + git config --global push.default simple + git add dist/* + git add docs/* + git add detections/* + git commit --allow-empty -m "updating docs and package bits [ci skip]" + # Push quietly to prevent showing the token in log + #No need to provide any credentials + git push + + + publish-github-release: + #Github-maintained release action is in archived state: https://github.com/actions/create-release + #They recommend several and we use the following with the most stars: https://github.com/softprops/action-gh-release + runs-on: ubuntu-latest + needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github] + #Only run when tagged + if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: + + #Get the artifacts that we need + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + path: . + name: content-latest + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + path: . + name: appinspect_reports + + #Rename those artifacts appropriately + - name: Set tag + id: vars + run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}" + + - name: Rename the content-update appropriately + run: | + cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz + cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz + + #No checksum on the reports + cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz + + cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt + + #Upload all of the artifacts that we have created using the third party + #action recommended bu Github + - name: Upload Release Artifacts + uses: softprops/action-gh-release@v1 + with: + files: | + DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz + DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz + report-${{ steps.vars.outputs.tag }}.tar.gz + checksum-${{ steps.vars.outputs.tag }}.txt + + + + attack-range-update: + runs-on: ubuntu-latest + needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release] + #Only run when tagged + if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: + + - uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + path: . + name: content-latest + + #Official, Verified Amazon-AWS Github Account Provided Action + - uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + + - name: Sync latest ESCU to the Attack Range S3 bucket for apps + run: | + aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/ + # make the file public since it is not by default + aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read + + master-api-update: + runs-on: ubuntu-latest + needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] + #Only run when tagged + if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: + - name: Checkout Repo + uses: actions/checkout@v2 + with: + ref: 'develop' + + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + #Get the virtualenv set up + rm -rf venv + python3 -m venv --clear venv + source venv/bin/activate + python3 -m pip install -q -r requirements.txt + + - name: Create Baseline Folder + run: | + source venv/bin/activate + python3 bin/create_baseline_folder.py + + #Official, Verified Amazon-AWS Github Account Provided Action + - uses: aws-actions/configure-aws-credentials@v1 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + + - name: Update API sources + run: | + aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml" + aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml" + aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml" + aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml" + aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml" + aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv" + aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml" + aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml" + - name: Security Content API Smoke Test + run: | + API_URL='https://content.splunkresearch.com/detections' + API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" $API_URL) + echo "Security Content API Status: $API_STATUS" + if [ "$API_STATUS" != "200" ]; then + echo "Error [Security Content API status: $API_STATUS]" + exit 1 + fi + + From b2709ac415c493266c4e4f0e72fd4e78d42435e1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 11:20:25 -0700 Subject: [PATCH 39/70] Updated semgrep to generate and upload an output file because the semgrep repo/action has been fixed. --- .github/workflows/semgrep-analysis.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml index c6aa2cede4..9c3ea7cee0 100644 --- a/.github/workflows/semgrep-analysis.yml +++ b/.github/workflows/semgrep-analysis.yml @@ -41,16 +41,15 @@ jobs: # Scan code using project's configuration on https://semgrep.dev/manage - uses: returntocorp/semgrep-action@v1 with: - #The following line is commented out for now pending a fix to the semgrep repo - #generateSarif: "1" + generateSarif: "1" config: >- # more at semgrep.dev/explore p/security-audit p/secrets # Upload SARIF file generated in previous step #The following lines are commented out right now pending a fix to the semgrep repo - # - name: Upload SARIF file - # uses: github/codeql-action/upload-sarif@v1 - # with: - # sarif_file: semgrep.sarif - # if: always() + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: semgrep.sarif + if: always() From 2852018754be86b25dffadae8c717c088e59781a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 11:34:41 -0700 Subject: [PATCH 40/70] Changed S3 pushes to test buckets for smoketesting of new release-checks.yml --- .github/workflows/release-checks.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 94e167ab6c..3f133dc3a8 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -123,7 +123,7 @@ jobs: - name: Upload Reporting run: | - aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg" + aws s3 cp bin/reporting s3://security-content-testing/reporting --recursive --exclude "*" --include "*.svg" update-sources-github: runs-on: ubuntu-latest @@ -293,9 +293,9 @@ jobs: - name: Sync latest ESCU to the Attack Range S3 bucket for apps run: | - aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/ + aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries-testing/ # make the file public since it is not by default - aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read + aws s3api put-object-acl --bucket attack-range-appbinaries-testing --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read master-api-update: runs-on: ubuntu-latest @@ -337,16 +337,16 @@ jobs: - name: Update API sources run: | - aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml" - aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml" - aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml" - aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml" - aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml" - aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv" - aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml" - aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml" + aws s3 rm s3://security-content-testing --recursive --exclude "*" --include "*.yml" + aws s3 cp stories s3://security-content-testing/stories --recursive --exclude "*" --include "*.yml" + aws s3 cp baselines s3://security-content-testing/baselines --recursive --exclude "*" --include "*.yml" + aws s3 cp detections s3://security-content-testing/detections --recursive --exclude "*" --include "*.yml" + aws s3 cp response_tasks s3://security-content-testing/response_tasks --recursive --exclude "*" --include "*.yml" + aws s3 cp responses s3://security-content-testing/responses --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content-testing/lookups --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content-testing/lookups --recursive --exclude "*" --include "*.csv" + aws s3 cp macros s3://security-content-testing/macros --recursive --exclude "*" --include "*.yml" + aws s3 cp deployments s3://security-content-testing/deployments --recursive --exclude "*" --include "*.yml" - name: Security Content API Smoke Test run: | API_URL='https://content.splunkresearch.com/detections' From 8ede691e4bf1d93172c481c446067d66fafff8d1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 12:01:10 -0700 Subject: [PATCH 41/70] For testing purposes, added release-checks.yml running on WorkflowSplit branch. --- .github/workflows/release-checks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 3f133dc3a8..75207219c6 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -2,7 +2,7 @@ name: release-checks on: workflow_run: workflows: ["validate-and-build"] - branches: ["develop"] + branches: ["develop", "WorkflowSplit"] types: - completed From 50cfcd0b51d5bf0ed88384545f64224f00ffefdf Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 12:12:27 -0700 Subject: [PATCH 42/70] Fixed parameters for when release-checks workflow_run runs. It doesn't run on a branch because tags/releases are on any branch. --- .github/workflows/release-checks.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 75207219c6..901e35d754 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -2,9 +2,8 @@ name: release-checks on: workflow_run: workflows: ["validate-and-build"] - branches: ["develop", "WorkflowSplit"] - types: - - completed + types: [completed] + jobs: From e00100eb83192197cba43c7966a045d2da7634aa Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 13:00:55 -0700 Subject: [PATCH 43/70] Removed incorrect 'needs' from the release yml file --- .github/workflows/release-checks.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 901e35d754..00a40668ce 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -9,7 +9,6 @@ on: jobs: run-appinspect: runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package] #Only run when tagged if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: @@ -79,7 +78,7 @@ jobs: create-report: runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect] + needs: [run-appinspect] #Only run when tagged if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: @@ -126,7 +125,7 @@ jobs: update-sources-github: runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report] + needs: [run-appinspect, create-report] #Only run when tagged if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: @@ -221,7 +220,7 @@ jobs: #Github-maintained release action is in archived state: https://github.com/actions/create-release #They recommend several and we use the following with the most stars: https://github.com/softprops/action-gh-release runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github] + needs: [run-appinspect, create-report, update-sources-github] #Only run when tagged if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: @@ -270,7 +269,7 @@ jobs: attack-range-update: runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release] + needs: [run-appinspect, create-report, update-sources-github, publish-github-release] #Only run when tagged if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: @@ -298,7 +297,7 @@ jobs: master-api-update: runs-on: ubuntu-latest - needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] + needs: [run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] #Only run when tagged if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: From 48d4587f2b0ec0dccd42f337b1ec945829fe8caf Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 14:31:08 -0700 Subject: [PATCH 44/70] Adding tag canary to gert workflow_run working correctly. --- .github/workflows/release-checks.yml | 43 ++++++++++++++++++++---- .github/workflows/validate-and-build.yml | 11 +++++- 2 files changed, 46 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 00a40668ce..1bc473cbbe 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -4,13 +4,46 @@ on: workflows: ["validate-and-build"] types: [completed] - + jobs: + + #Check that the validate-and-build workflow succeeded + check-validate-and-build-success: + runs-on: ubuntu-latest + steps: + - name: Check Failure + run: | + if ${{ github.event.workflow_run.conclusion == 'success' }} ; then + echo "SUCCESS: validate-and-build.yml ran successfully. Continue" + exit 0 + else + echo "FAIL: validate-and-build.yml DID NOT run successfully. Terminating..." + exit 1 + fi + + + #Enusre that we are running on a tag. There is no good way to see if this was + #triggered from a tag/release, so we use the creation of an aritifact in the + #validate-and-build workflow to represent it + verify-tag: + runs-on: ubuntu-latest + steps: + - name: Restore Content-Pack Artifacts for AppInspect testing + uses: dawidd6/action-download-artifact@v2 + with: + workflow: validate-and-build.yml + workflow_conclusion: success + name: tag-canary + path: . + run: | + #If this file does not exist, then cat will return a nonzero status (failure) + #and the entire workflow will fail + cat tag-canary.txt + run-appinspect: runs-on: ubuntu-latest #Only run when tagged - if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: - name: Checkout Repo @@ -80,7 +113,6 @@ jobs: runs-on: ubuntu-latest needs: [run-appinspect] #Only run when tagged - if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: - name: Checkout Repo uses: actions/checkout@v2 @@ -127,7 +159,6 @@ jobs: runs-on: ubuntu-latest needs: [run-appinspect, create-report] #Only run when tagged - if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: - name: Checkout Repo @@ -222,7 +253,7 @@ jobs: runs-on: ubuntu-latest needs: [run-appinspect, create-report, update-sources-github] #Only run when tagged - if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} + steps: #Get the artifacts that we need @@ -271,7 +302,6 @@ jobs: runs-on: ubuntu-latest needs: [run-appinspect, create-report, update-sources-github, publish-github-release] #Only run when tagged - if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: - uses: dawidd6/action-download-artifact@v2 @@ -299,7 +329,6 @@ jobs: runs-on: ubuntu-latest needs: [run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] #Only run when tagged - if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }} steps: - name: Checkout Repo uses: actions/checkout@v2 diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml index 54767b940c..e131ca8203 100644 --- a/.github/workflows/validate-and-build.yml +++ b/.github/workflows/validate-and-build.yml @@ -250,6 +250,7 @@ jobs: cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz >> checksum.txt + touch tag-canary.txt - name: store_artifacts uses: actions/upload-artifact@v2 with: @@ -263,4 +264,12 @@ jobs: path: | build/DA-ESS-ContentUpdate-latest.tar.gz build/DA-ESS_AmazonWebServices_Content-latest.tar.gz - build/checksum.txt \ No newline at end of file + build/checksum.txt + + #Store the tag to indicate that this was a tagged build + - name: store_artifacts + uses: actions/upload-artifact@v2 + with: + name: tag-canary + path: | + tag-canary.txt \ No newline at end of file From 216ce46f571eb6bf19f0dbe767bb40ede3bbad4f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 14:33:27 -0700 Subject: [PATCH 45/70] Fixed checking for the existence of the tag canary. --- .github/workflows/release-checks.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 1bc473cbbe..211e81d0d4 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -29,13 +29,14 @@ jobs: verify-tag: runs-on: ubuntu-latest steps: - - name: Restore Content-Pack Artifacts for AppInspect testing + - name: Try to get the canary uses: dawidd6/action-download-artifact@v2 with: workflow: validate-and-build.yml workflow_conclusion: success name: tag-canary path: . + - name: Check for existence of canary run: | #If this file does not exist, then cat will return a nonzero status (failure) #and the entire workflow will fail From 57ca5d3ddc0ac8d14c9728cd81eb9f5de8af92a9 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 14:43:54 -0700 Subject: [PATCH 46/70] Added dependencies for release-checks. --- .github/workflows/release-checks.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 211e81d0d4..7e1ecb89b8 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -28,6 +28,7 @@ jobs: #validate-and-build workflow to represent it verify-tag: runs-on: ubuntu-latest + needs: [check-validate-and-build-success] steps: - name: Try to get the canary uses: dawidd6/action-download-artifact@v2 @@ -44,6 +45,7 @@ jobs: run-appinspect: runs-on: ubuntu-latest + needs: [check-validate-and-build-success, verify-tag] #Only run when tagged steps: @@ -112,7 +114,7 @@ jobs: create-report: runs-on: ubuntu-latest - needs: [run-appinspect] + needs: [check-validate-and-build-success, verify-tag, run-appinspect] #Only run when tagged steps: - name: Checkout Repo @@ -158,7 +160,7 @@ jobs: update-sources-github: runs-on: ubuntu-latest - needs: [run-appinspect, create-report] + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report] #Only run when tagged steps: @@ -252,7 +254,7 @@ jobs: #Github-maintained release action is in archived state: https://github.com/actions/create-release #They recommend several and we use the following with the most stars: https://github.com/softprops/action-gh-release runs-on: ubuntu-latest - needs: [run-appinspect, create-report, update-sources-github] + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report, update-sources-github] #Only run when tagged steps: @@ -301,7 +303,7 @@ jobs: attack-range-update: runs-on: ubuntu-latest - needs: [run-appinspect, create-report, update-sources-github, publish-github-release] + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report, update-sources-github, publish-github-release] #Only run when tagged steps: @@ -328,7 +330,7 @@ jobs: master-api-update: runs-on: ubuntu-latest - needs: [run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] + needs: [check-validate-and-build-success, verify-tag, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] #Only run when tagged steps: - name: Checkout Repo From 7ee10654b928b2a75d7c6636dd9b3aad53638176 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 15:05:01 -0700 Subject: [PATCH 47/70] Adding run_id to the download action. --- .github/workflows/release-checks.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 7e1ecb89b8..2b06a0c3d8 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -35,6 +35,7 @@ jobs: with: workflow: validate-and-build.yml workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} name: tag-canary path: . - name: Check for existence of canary @@ -60,6 +61,7 @@ jobs: with: workflow: validate-and-build.yml workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} name: content-latest path: build/ @@ -179,6 +181,7 @@ jobs: with: workflow: validate-and-build.yml workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} path: . name: content-latest @@ -264,12 +267,14 @@ jobs: with: workflow: validate-and-build.yml workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} path: . name: content-latest - uses: dawidd6/action-download-artifact@v2 with: workflow: validate-and-build.yml workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} path: . name: appinspect_reports @@ -311,6 +316,7 @@ jobs: with: workflow: validate-and-build.yml workflow_conclusion: success + run_id: ${{ github.event.workflow_run.id }} path: . name: content-latest From 9871075378d423cacf00ffb2646d25b3405742d7 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 15:14:57 -0700 Subject: [PATCH 48/70] Unable to find artifact, trying again. --- .github/workflows/release-checks.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 2b06a0c3d8..b2787199c3 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -34,10 +34,8 @@ jobs: uses: dawidd6/action-download-artifact@v2 with: workflow: validate-and-build.yml - workflow_conclusion: success run_id: ${{ github.event.workflow_run.id }} name: tag-canary - path: . - name: Check for existence of canary run: | #If this file does not exist, then cat will return a nonzero status (failure) From 64e3776a118af308e85488eaf9e579de49bee46e Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 15:25:05 -0700 Subject: [PATCH 49/70] Adding the token --- .github/workflows/release-checks.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index b2787199c3..d7b7723cba 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -33,14 +33,16 @@ jobs: - name: Try to get the canary uses: dawidd6/action-download-artifact@v2 with: + github_token: "${{ secrets.GITHUB_TOKEN }}" workflow: validate-and-build.yml run_id: ${{ github.event.workflow_run.id }} name: tag-canary + path: canary - name: Check for existence of canary run: | #If this file does not exist, then cat will return a nonzero status (failure) #and the entire workflow will fail - cat tag-canary.txt + cat canary/tag-canary.txt run-appinspect: runs-on: ubuntu-latest From 0c6f194e2cd5b103c16c2489074491166e0603ac Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 15:40:36 -0700 Subject: [PATCH 50/70] another method of getting workflow artifact --- .github/workflows/release-checks.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index d7b7723cba..474a0b7b26 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -2,7 +2,8 @@ name: release-checks on: workflow_run: workflows: ["validate-and-build"] - types: [completed] + types: + - completed @@ -34,8 +35,9 @@ jobs: uses: dawidd6/action-download-artifact@v2 with: github_token: "${{ secrets.GITHUB_TOKEN }}" - workflow: validate-and-build.yml - run_id: ${{ github.event.workflow_run.id }} + workflow: ${{ github.event.workflow_run.workflow_id }} + #workflow: validate-and-build.yml + #run_id: ${{ github.event.workflow_run.id }} name: tag-canary path: canary - name: Check for existence of canary From 72e30881832a72fc5a324a13ed7dbacfbd45501f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 15:48:56 -0700 Subject: [PATCH 51/70] updated last store artifacts name --- .github/workflows/validate-and-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml index e131ca8203..c3255833a5 100644 --- a/.github/workflows/validate-and-build.yml +++ b/.github/workflows/validate-and-build.yml @@ -267,7 +267,7 @@ jobs: build/checksum.txt #Store the tag to indicate that this was a tagged build - - name: store_artifacts + - name: store_artifacts_three uses: actions/upload-artifact@v2 with: name: tag-canary From ebef1c146f215e8f58fc5ae56af8d37f4007a535 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 26 Aug 2021 16:04:44 -0700 Subject: [PATCH 52/70] Changed upload path for canary. --- .github/workflows/release-checks.yml | 20 ++++++++++---------- .github/workflows/validate-and-build.yml | 2 +- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml index 474a0b7b26..ac27b9fe4e 100644 --- a/.github/workflows/release-checks.yml +++ b/.github/workflows/release-checks.yml @@ -13,16 +13,16 @@ jobs: check-validate-and-build-success: runs-on: ubuntu-latest steps: - - name: Check Failure - run: | - if ${{ github.event.workflow_run.conclusion == 'success' }} ; then - echo "SUCCESS: validate-and-build.yml ran successfully. Continue" - exit 0 - else - echo "FAIL: validate-and-build.yml DID NOT run successfully. Terminating..." - exit 1 - fi - + - if: github.event.workflow_run.conclusion != 'success' + name: Abort if failed + run: | + echo "FAIL: validate-and-build.yml DID NOT run successfully. Terminating..." + exit 1 + - name: Print Success + run: | + echo "SUCCESS: validate-and-build.yml ran successfully. Continue" + exit 0 + #Enusre that we are running on a tag. There is no good way to see if this was #triggered from a tag/release, so we use the creation of an aritifact in the diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml index c3255833a5..bdaf0c1f93 100644 --- a/.github/workflows/validate-and-build.yml +++ b/.github/workflows/validate-and-build.yml @@ -272,4 +272,4 @@ jobs: with: name: tag-canary path: | - tag-canary.txt \ No newline at end of file + build/tag-canary.txt \ No newline at end of file From f0eb7ecfce178561a0323802abe932834fce0220 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 09:23:01 +0200 Subject: [PATCH 53/70] devsecops --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index eac427de91..5346d484af 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -54,4 +54,3 @@ tags: automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json - From b0f5e635b49050f4db6c8425d356d731525f1d8d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:13:24 +0200 Subject: [PATCH 54/70] update packages --- automated_detection_testing/requirements.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 8e3dcc8f44..5182fa1312 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -19,6 +19,7 @@ certifi==2021.5.30 cffi==1.14.5 cfgv==3.3.0 chardet==4.0.0 +colorama==0.4.4 configparser==5.0.2 contextlib2==0.6.0.post1 Deprecated==1.2.12 @@ -55,6 +56,7 @@ PyInquirer==1.0.3 PyJWT==2.1.0 PyNaCl==1.4.0 pyparsing==2.4.7 +pyperclip==1.8.2 pytest==6.2.4 python-daemon==2.3.0 python-dateutil==2.8.1 From 9107cd7b2a570777265164e13ae09094922248db Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:14:17 +0200 Subject: [PATCH 55/70] small update --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index 5346d484af..eac427de91 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -54,3 +54,4 @@ tags: automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json + From dac2b862fd6e1b98b7a900d3619f41e044493d67 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:16:06 +0200 Subject: [PATCH 56/70] small update --- .../{validate-and-build.yml => build-and_validate.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename .github/workflows/{validate-and-build.yml => build-and_validate.yml} (99%) diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/build-and_validate.yml similarity index 99% rename from .github/workflows/validate-and-build.yml rename to .github/workflows/build-and_validate.yml index bdaf0c1f93..8fbbf86819 100644 --- a/.github/workflows/validate-and-build.yml +++ b/.github/workflows/build-and_validate.yml @@ -12,7 +12,7 @@ -name: validate-and-build +name: build-and-validate on: [push, pull_request] jobs: validate-tag-if-present: From 09afa4b1e25fe27d6bddb0f1a8b0eac6693aded4 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:28:59 +0200 Subject: [PATCH 57/70] bug fix github actions --- .../workflows/{build-and_validate.yml => build-and-validate.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{build-and_validate.yml => build-and-validate.yml} (100%) diff --git a/.github/workflows/build-and_validate.yml b/.github/workflows/build-and-validate.yml similarity index 100% rename from .github/workflows/build-and_validate.yml rename to .github/workflows/build-and-validate.yml From d680c232b060d5edbc7137a612319c4e6d10c4e4 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 27 Aug 2021 08:32:46 +0000 Subject: [PATCH 58/70] Added detection testing service results inGsuite Email With Known Abuse Web Service Link --- ...mail_with_known_abuse_web_service_link.yml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index cf0bf78c3a..35957793cd 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -5,20 +5,22 @@ date: '2021-08-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. - This event can encounter some normal email traffic within organization and external email that normally using this application and services. -search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") -| rex field=source.from_header_address "[^@]+@(?[^@]+)" - | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytics is to detect a gmail containing a link that are known + to be abused by malware or attacker like pastebin, telegram and discord to deliver + malicious payload. This event can encounter some normal email traffic within organization + and external email that normally using this application and services. +search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") + | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address + "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" + and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains + min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address + subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file + logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection. +known_false_positives: normal email contains this link that are known application + within the organization or network can be catched by this detection. references: - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ tags: @@ -39,7 +41,6 @@ tags: security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - Source:Endpoint @@ -50,8 +51,8 @@ tags: type: User role: - attacker - - name: destination{}.address + - name: destination{}.address type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From fd6d8378728b8561f1bb617b0468fbe34d3572fd Mon Sep 17 00:00:00 2001 From: root Date: Fri, 27 Aug 2021 08:37:08 +0000 Subject: [PATCH 59/70] Added detection testing service results inGsuite Suspicious Shared File Name --- .../gsuite_suspicious_shared_file_name.yml | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 9b7bd30b24..dc8efaa7b0 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -5,22 +5,27 @@ date: '2021-08-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. - This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. - This detection can also catch some normal email communication between organization and its external customer. -search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") - | rex field=parameters.owner "[^@]+@(?[^@]+)" - | rex field=parameters.target_user "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a shared file in google drive with suspicious + file name that are commonly used by spear phishing campaign. This technique is very + popular to lure the user by running a malicious document or click a malicious link + within the shared file that will redirected to malicious website. This detection + can also catch some normal email communication between organization and its external + customer. +search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" + IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", + "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", + "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", + "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex + field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" + and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime + max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title + parameters.doc_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file + logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -known_false_positives: normal user or normal transaction may contain the subject and file type attachment that - this detection try to search +known_false_positives: normal user or normal transaction may contain the subject and + file type attachment that this detection try to search references: - https://www.redhat.com/en/topics/devops/what-is-devsecops - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf @@ -49,7 +54,6 @@ tags: security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - Source:Endpoint @@ -64,4 +68,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 63245f7842369f5457551e938f4dfe48e777fac8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:52:17 +0200 Subject: [PATCH 60/70] merged --- detections/cloud/kubernetes_nginx_ingress_lfi.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index b91a2780ab..b14e3e6ba6 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -52,3 +52,4 @@ tags: automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log + From 776ffd375ae61604a6b07a32d7602ee15b648399 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 27 Aug 2021 09:55:45 +0000 Subject: [PATCH 61/70] Added detection testing service results inGsuite Email Suspicious Subject With Attachment --- ...ail_suspicious_subject_with_attachment.yml | 52 +++++++++++-------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index cba0a58be3..f49c599634 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -5,27 +5,33 @@ date: '2021-08-19' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. - This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment - send from external email account because of the effective social engineering of subject related to delivery, bank and so on. - On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. - avoid click link or opening the attachment if you are not expecting this type of e-mail. -search: '`gsuite_gmail` num_message_attachments > 0 - subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) - attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) - | rex field=source.from_header_address "[^@]+@(?[^@]+)" - | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by - destination{}.service num_message_attachments subject destination{}.address source.address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `gsuite_email_suspicious_subject_with_attachment_filter`' +description: This search is to detect a gsuite email contains suspicious subject having + known file type used in spear phishing. This technique is a common and effective + entry vector of attacker to compromise a network by luring the user to click or + execute the suspicious attachment send from external email account because of the + effective social engineering of subject related to delivery, bank and so on. On + the other hand this detection may catch a normal email traffic related to legitimate + transaction so better to check the email sender, spelling and etc. avoid click link + or opening the attachment if you are not expecting this type of e-mail. +search: "`gsuite_gmail` num_message_attachments > 0 subject IN (\"*dhl*\", \"* ups\ + \ *\u201D, \u201C*delivery*\u201D, \u201C*parcel*\u201D, \u201C*label*\u201D, \u201C\ + *invoice*\u201D, \u201C*postal*\u201D, \u201C* fedex *\u201D, \u201C* usps *\u201D\ + , \u201C* express *\u201D, \u201C*shipment*\u201D, \u201C*Banking/Tax*\u201D,\u201D\ + *shipment*\u201D, \u201C*new order*\u201D) attachment{}.file_extension_type IN (\"\ + doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"pdf\", \"zip\", \"rar\u201D\ + , \u201Chtml\u201D,\u201Dhtm\u201D,\u201Dhta\u201D) | rex field=source.from_header_address\ + \ \"[^@]+@(?[^@]+)\" | rex field=destination{}.address \"[^@]+@(?[^@]+)\"\ + \ | where not source_domain=\"internal_test_email.com\" and dest_domain=\"internal_test_email.com\"\ + \ | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type)\ + \ as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size)\ + \ as payload_size by destination{}.service num_message_attachments subject destination{}.address\ + \ source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ + \ | `gsuite_email_suspicious_subject_with_attachment_filter`" how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file + logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -known_false_positives: normal user or normal transaction may contain the subject and file type attachment that - this detection try to search. +known_false_positives: normal user or normal transaction may contain the subject and + file type attachment that this detection try to search. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf @@ -33,7 +39,7 @@ tags: analytic_story: - DevSecOps dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -47,7 +53,6 @@ tags: security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - Source:Endpoint @@ -58,7 +63,8 @@ tags: type: User role: - attacker - - name: destination{}.address + - name: destination{}.address type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 1ac0f6be2234a63a3f6854de473fca3e9b7d920f Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 12:43:54 +0200 Subject: [PATCH 62/70] improve testing --- automated_detection_testing/detection_service.py | 4 ++-- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py index 652f3a9d1e..022c2dadcd 100644 --- a/automated_detection_testing/detection_service.py +++ b/automated_detection_testing/detection_service.py @@ -148,7 +148,7 @@ def main(args): detection_obj['tags']['dataset'] = datasets with open(file_path, 'w') as f: - yaml.dump(detection_obj, f, sort_keys=False) + yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True) changed_file_path = 'detections/' + test['detection_result']['detection_file'] security_content_repo_obj.index.add([changed_file_path]) @@ -177,7 +177,7 @@ def main(args): def load_file(file_path): - with open(file_path, 'r') as stream: + with open(file_path, 'r', encoding="utf-8") as stream: try: file = list(yaml.safe_load_all(stream))[0] except yaml.YAMLError as exc: diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 619694db3c..f05fea3a44 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -80,3 +80,4 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + From c78f8b16563c5c0f20868c68a065c70bd51fb0af Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 12:44:56 +0200 Subject: [PATCH 63/70] changed detection --- ...ail_suspicious_subject_with_attachment.yml | 25 ++++++++----------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index f49c599634..e164d26f14 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -13,20 +13,17 @@ description: This search is to detect a gsuite email contains suspicious subject the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail. -search: "`gsuite_gmail` num_message_attachments > 0 subject IN (\"*dhl*\", \"* ups\ - \ *\u201D, \u201C*delivery*\u201D, \u201C*parcel*\u201D, \u201C*label*\u201D, \u201C\ - *invoice*\u201D, \u201C*postal*\u201D, \u201C* fedex *\u201D, \u201C* usps *\u201D\ - , \u201C* express *\u201D, \u201C*shipment*\u201D, \u201C*Banking/Tax*\u201D,\u201D\ - *shipment*\u201D, \u201C*new order*\u201D) attachment{}.file_extension_type IN (\"\ - doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"pdf\", \"zip\", \"rar\u201D\ - , \u201Chtml\u201D,\u201Dhtm\u201D,\u201Dhta\u201D) | rex field=source.from_header_address\ - \ \"[^@]+@(?[^@]+)\" | rex field=destination{}.address \"[^@]+@(?[^@]+)\"\ - \ | where not source_domain=\"internal_test_email.com\" and dest_domain=\"internal_test_email.com\"\ - \ | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type)\ - \ as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size)\ - \ as payload_size by destination{}.service num_message_attachments subject destination{}.address\ - \ source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ - \ | `gsuite_email_suspicious_subject_with_attachment_filter`" +search: '`gsuite_gmail` num_message_attachments > 0 + subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") + attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") + | rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by + destination{}.service num_message_attachments subject destination{}.address source.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_suspicious_subject_with_attachment_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. From 426d5c4c850ee05b6dd26025a3ebe78622758923 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Aug 2021 12:58:41 +0200 Subject: [PATCH 64/70] dev_git --- tests/cloud/github_commit_changes_in_master.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/github_commit_changes_in_master.test.yml b/tests/cloud/github_commit_changes_in_master.test.yml index 7c0ea5df89..6901948db5 100644 --- a/tests/cloud/github_commit_changes_in_master.test.yml +++ b/tests/cloud/github_commit_changes_in_master.test.yml @@ -3,7 +3,7 @@ tests: - name: Github Commit Changes In Master file: cloud/github_commit_changes_in_master.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: github_push_master.log From db38f31f3c050dbb2e4aa8ce412279fd658692df Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:59:16 +0200 Subject: [PATCH 65/70] Delete gsuite_email_with_known_abuse_web_service_link.yml --- ...mail_with_known_abuse_web_service_link.yml | 57 ------------------- 1 file changed, 57 deletions(-) delete mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml deleted file mode 100644 index 440dbbf50b..0000000000 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Gsuite Email With Known Abuse Web Service Link -id: 8630aa22-042b-11ec-af39-acde48001122 -version: 1 -date: '2021-08-23' -author: Teoderick Contreras, Splunk -type: Anomaly -datamodel: [] -description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. - This event can encounter some normal email traffic within organization and external email that normally using this application and services. -search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") -| rex field=source.from_header_address "[^@]+@(?[^@]+)" - | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `gsuite_email_with_known_abuse_web_service_link_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. -known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection. -references: -- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ -tags: - analytic_story: - - DevSecOps - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 - context: - - Source:Endpoint - - Stage:Reconnaissance - message: suspicious email from $source.address$ to $destination{}.address$ - observable: - - name: source.address - type: User - role: - - attacker - - name: destination{}.address - type: User - role: - - Victim - \ No newline at end of file From 3ac41ddb1af308009cb65ca07b582f4f9b259640 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 27 Aug 2021 11:06:30 +0000 Subject: [PATCH 66/70] Added detection testing service results inGsuite Email Suspicious Subject With Attachment --- ...ail_suspicious_subject_with_attachment.yml | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index e164d26f14..75f7b438c7 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -13,16 +13,17 @@ description: This search is to detect a gsuite email contains suspicious subject the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail. -search: '`gsuite_gmail` num_message_attachments > 0 - subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") - attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") - | rex field=source.from_header_address "[^@]+@(?[^@]+)" - | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by - destination{}.service num_message_attachments subject destination{}.address source.address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", + "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps + *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type + IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") + | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address + "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" + and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime + max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, + values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size + by destination{}.service num_message_attachments subject destination{}.address + source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_subject_with_attachment_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file From b90326f55c847a8bf4c7126a60de3e3f8943293f Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Aug 2021 13:28:06 +0200 Subject: [PATCH 67/70] dev_git --- macros/github.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/github.yml b/macros/github.yml index 686cb4d1bf..5064aa92ed 100644 --- a/macros/github.yml +++ b/macros/github.yml @@ -1,4 +1,4 @@ -definition: sourcetype="aws:firehose:json" +definition: sourcetype=aws:firehose:json description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: github \ No newline at end of file From 4cd7b43ed0ed57bbc91cafe06c6bd8a16867e00f Mon Sep 17 00:00:00 2001 From: root Date: Fri, 27 Aug 2021 11:49:55 +0000 Subject: [PATCH 68/70] Added detection testing service results inGithub Commit Changes In Master --- .../cloud/github_commit_changes_in_master.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 73636df24e..309a3a0571 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -5,16 +5,18 @@ date: '2021-08-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -description: This search is to detect a pushed or commit to master or main branch. - This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a - PR for review. of course in some cases admin of the project may did a changes directly to master branch -search: '`github` branches{}.name = main - | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `github_commit_changes_in_master_filter`' +description: This search is to detect a pushed or commit to master or main branch. + This is to avoid unwanted modification to master without a review to the changes. + Ideally in terms of devsecops the changes made in a branch and do a PR for review. + of course in some cases admin of the project may did a changes directly to master + branch +search: '`github` branches{}.name = main | stats count min(_time) as firstTime max(_time) + as lastTime by commit.author.html_url commit.commit.author.email commit.author.login + commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project. + logs related to github logs having the fork, commit, push metadata that can be use + to monitor the changes in a github project. known_false_positives: admin can do changes directly to master branch references: - https://www.redhat.com/en/topics/devops/what-is-devsecops @@ -35,8 +37,7 @@ tags: - _time security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - Source:Endpoint @@ -47,5 +48,4 @@ tags: type: User role: - attacker - - \ No newline at end of file + automated_detection_testing: passed From cdc6665afd38709c58b409660b5b6669baf3a4d7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Aug 2021 14:01:41 +0200 Subject: [PATCH 69/70] dev_git --- detections/cloud/github_commit_changes_in_master.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 73636df24e..55c2f1309c 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -8,7 +8,7 @@ datamodel: [] description: This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch -search: '`github` branches{}.name = main +search: '`github` branches{}.name = main OR branches{}.name = master | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 2953ba3cbc31d902320219839abc54cb3f5a6dda Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 14:04:26 +0200 Subject: [PATCH 70/70] Update github_commit_changes_in_master.yml --- detections/cloud/github_commit_changes_in_master.yml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index e9f2216461..664e6696d0 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -5,7 +5,6 @@ date: '2021-08-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -<<<<<<< HEAD description: This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch @@ -14,17 +13,6 @@ search: '`github` branches{}.name = main OR branches{}.name = master | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`' -======= -description: This search is to detect a pushed or commit to master or main branch. - This is to avoid unwanted modification to master without a review to the changes. - Ideally in terms of devsecops the changes made in a branch and do a PR for review. - of course in some cases admin of the project may did a changes directly to master - branch -search: '`github` branches{}.name = main | stats count min(_time) as firstTime max(_time) - as lastTime by commit.author.html_url commit.commit.author.email commit.author.login - commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`' ->>>>>>> 4cd7b43ed0ed57bbc91cafe06c6bd8a16867e00f how_to_implement: To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.