splunk-security_content/docs/_posts/2021-09-01-circle_ci_disable_security_step.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Circle CI Disable Security Step	Compromise Client Software Binary	Cloud	2021-09-01	true		Compromise Client Software Binary Persistence Splunk Enterprise Splunk Enterprise Security Splunk Cloud

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search looks for disable security step in CircleCI pipeline.

• Type: Anomaly
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel:
• Last Updated: 2021-09-01
• Author: Patrick Bareiss, Splunk
• ID: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97

ATT&CK

ID	Technique	Tactic
T1554	Compromise Client Software Binary	Persistence

Search

`circleci` 
| rename workflows.job_id AS job_id 
| join job_id [ 
| search `circleci` 
| stats values(name) as step_names count by job_id job_name ] 
| stats count by step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{} 
| rename vcs.* as * , owners{} as user 
| lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step 
| search mandatory_step=* 
| eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0) 
| where mandatory_step_executed=0 
| rex field=url "(?<repository>[^\/]*\/[^\/]*)$" 
| eval phase="build"  
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `circle_ci_disable_security_step_filter`

Macros

The SPL above uses the following Macros:

• circleci
• security_content_ctime

Note that circle_ci_disable_security_step_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Lookups

The SPL above uses the following Lookups:

• mandatory_step_for_job with data

Required field

• _times

How To Implement

You must index CircleCI logs.

Known False Positives

unknown

Associated Analytic story

• Dev Sec Ops

Kill Chain Phase

• Actions on Objectives

RBA

Risk Score	Impact	Confidence	Message
72.0	80	90	disable security step mandatory_step in job job_name from user user

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1554/circle_ci_disable_security_step/circle_ci_disable_security_step.json

source | version: 1