mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
50 lines
3.1 KiB
YAML
50 lines
3.1 KiB
YAML
name: Circle CI Disable Security Step
|
|
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
|
|
version: 1
|
|
date: '2021-09-01'
|
|
author: Patrick Bareiss, Splunk
|
|
status: experimental
|
|
type: Anomaly
|
|
description: |-
|
|
The following analytic detects the disablement of security steps in a CircleCI pipeline. Addressing instances of security step disablement in CircleCI pipelines can mitigate the risks associated with potential security vulnerabilities and unauthorized changes. A proactive approach helps protect the organization's infrastructure, data, and overall security posture. The detection is made by a Splunk query that searches for specific criteria within CircleCI logs through a combination of field renaming, joining, and statistical analysis to identify instances where security steps are disabled. It retrieves information such as job IDs, job names, commit details, and user information from the CircleCI logs. The detection is important because it indicates potential security vulnerabilities or unauthorized changes to the pipeline caused by someone within the organization intentionally or unintentionally disabling security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline and the associated infrastructure exposed to potential attacks, data breaches, or the introduction of malicious code into the pipeline. Investigate by reviewing the job name, commit details, and user information associated with the disablement of security steps. You must also examine any relevant on-disk artifacts and identify concurrent processes that might indicate the source of the attack or unauthorized change.
|
|
data_source: []
|
|
search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci`
|
|
| stats values(name) as step_names count by job_id job_name ] | stats count by step_names
|
|
job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
|
|
* , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name
|
|
AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names,
|
|
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url
|
|
"(?<repository>[^\/]*\/[^\/]*)$" | eval phase="build" | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
|
|
how_to_implement: You must index CircleCI logs.
|
|
known_false_positives: unknown
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Dev Sec Ops
|
|
asset_type: CircleCI
|
|
confidence: 90
|
|
impact: 80
|
|
message: disable security step $mandatory_step$ in job $job_name$ from user $user$
|
|
mitre_attack_id:
|
|
- T1554
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _times
|
|
risk_score: 72
|
|
security_domain: network
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1554/circle_ci_disable_security_step/circle_ci_disable_security_step.json
|
|
sourcetype: circleci
|
|
source: circleci
|