Skip to content

Commit 0400838

Browse files
nterl0knterl0k
authored
Merge branch 'splunk:develop' into nterl0k-t1486-bitlocker-sus-commands
2 parents 93cf789 + bc334de commit 0400838

File tree

900 files changed

+5039
-4025
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

900 files changed

+5039
-4025
lines changed

‎.github/labeler.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,8 @@ Lookups:
2222
Datasource:
2323
- changed-files:
2424
- any-glob-to-any-file: data_sources/*
25+
26+
Baselines:
27+
- changed-files:
28+
- any-glob-to-any-file: baselines/*
29+

‎.github/workflows/appinspect.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}"
3535
run: |
3636
echo $APPINSPECTUSERNAME
37-
contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments --enable-metadata-validation --suppress-missing-content-exceptions
37+
contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --enrichments --enable-metadata-validation --suppress-missing-content-exceptions
3838
echo "done appinspect"
3939
mkdir -p artifacts/app_inspect_report
4040
cp -r dist/*.html artifacts/app_inspect_report

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ Please use the [GitHub Issue Tracker](https://github.com/splunk/security_content
138138
If you have questions or need support, you can:
139139

140140
* Post a question to [Splunk Answers](http://answers.splunk.com)
141-
* Join the [#security-research](https://splunk-usergroups.slack.com/archives/C1S5BEF38) room in the [Splunk Slack channel](http://splunk-usergroups.slack.com)
141+
* Join the [#security-research](https://splunkcommunity.slack.com/archives/CDNHXVBGS) channel in the [Splunk Community Slack.](https://splk.it/slack)
142142

143143
## License
144144
Copyright 2022 Splunk Inc.

‎app_template/default/data/ui/views/feedback.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
<html>
77
<p5>You can contact the Splunk Threat Research team at<a href = "mailto:[email protected]">[email protected]</a> to send us support requests, bug reports, and questions.
88
<br>Specify the request type and the title of any related analytic stories, detections analytics where applicable.</br>
9-
You can also find us on the <b>#es-content-updates</b><a href = "http://splunk-usergroups.slack.com/"> Splunk Usergroups Slack channel.</a></p5>
9+
You can also find us on the <b>#es-content-updates</b><a href = "https://splk.it/slack/"> Splunk Community Slack channel.</a></p5>
1010
</html>
1111
</panel>
1212
</row>
13-
</form>
13+
</form>

‎data_sources/aws_cloudtrail_consolelogin.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,13 +90,13 @@ fields:
9090
- vendor_product
9191
- vendor_region
9292
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "accountId":
93-
"140429656527", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"},
93+
"111111111111", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"},
9494
"eventTime": "2022-10-19T20:33:38Z", "eventSource": "signin.amazonaws.com", "eventName":
9595
"ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent":
9696
"Go-http-client/1.1", "errorMessage": "No username found in supplied account", "requestParameters":
9797
null, "responseElements": {"ConsoleLogin": "Failure"}, "additionalEventData": {"LoginTo":
9898
"https://console.aws.amazon.com", "MobileVersion": "No", "MFAUsed": "No"}, "eventID":
9999
"9fcfb8c3-3fca-48db-85d2-7b107f9d95d0", "readOnly": false, "eventType": "AwsConsoleSignIn",
100-
"managementEvent": true, "recipientAccountId": "140429656527", "eventCategory":
100+
"managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":
101101
"Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
102102
"clientProvidedHostHeader": "signin.aws.amazon.com"}}'

‎data_sources/aws_cloudtrail_createvirtualmfadevice.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,13 +88,13 @@ fields:
8888
- vendor_product
8989
- vendor_region
9090
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId":
91-
"140429656527", "arn": "arn:aws:iam::140429656527:root", "accountId": "140429656527",
91+
"1111111111111111", "arn": "arn:aws:iam::1111111111111111:root", "accountId": "1111111111111111",
9292
"accessKeyId": "ASIASBMSCQHH2YXNXJBU", "sessionContext": {"sessionIssuer": {}, "webIdFederationData":
9393
{}, "attributes": {"creationDate": "2023-01-30T22:59:36Z", "mfaAuthenticated": "false"}}},
9494
"eventTime": "2023-01-30T23:02:23Z", "eventSource": "iam.amazonaws.com", "eventName":
9595
"CreateVirtualMFADevice", "awsRegion": "us-east-1", "sourceIPAddress": "23.93.193.6",
9696
"userAgent": "AWS Internal", "requestParameters": {"path": "/", "virtualMFADeviceName":
97-
"strt_mfa_2"}, "responseElements": {"virtualMFADevice": {"serialNumber": "arn:aws:iam::140429656527:mfa/strt_mfa_2"}},
97+
"strt_mfa_2"}, "responseElements": {"virtualMFADevice": {"serialNumber": "arn:aws:iam::1111111111111111:mfa/strt_mfa_2"}},
9898
"requestID": "2fbe2074-55f8-4ec6-ad32-0b250803cf46", "eventID": "7e1c493d-c3c3-4f4a-ae4f-8cdd38970027",
9999
"readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId":
100-
"140429656527", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}'
100+
"1111111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}'

‎data_sources/aws_cloudtrail_describeeventaggregates.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ fields:
8484
- vendor_product
8585
- vendor_region
8686
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId":
87-
"140429656527", "arn": "arn:aws:iam::140429656527:root", "accountId": "140429656527",
87+
"1111111111111111", "arn": "arn:aws:iam::1111111111111111:root", "accountId": "1111111111111111",
8888
"accessKeyId": "ASIASBMSCQHHQQ6LB24V", "sessionContext": {"sessionIssuer": {}, "webIdFederationData":
8989
{}, "attributes": {"creationDate": "2023-01-31T21:58:17Z", "mfaAuthenticated": "true"}}},
9090
"eventTime": "2023-02-01T02:52:34Z", "eventSource": "health.amazonaws.com", "eventName":
@@ -93,5 +93,5 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip
9393
"filter": {"eventStatusCodes": ["open", "upcoming"], "startTimes": [{"from": "Jan
9494
25, 2023 2:54:32 AM"}]}}, "responseElements": null, "requestID": "d6adf050-1d7a-4c25-9d48-0319e33f6f9a",
9595
"eventID": "201cee69-61ab-4ffb-80b7-bd31e81e0d82", "readOnly": true, "eventType":
96-
"AwsApiCall", "managementEvent": true, "recipientAccountId": "140429656527", "eventCategory":
96+
"AwsApiCall", "managementEvent": true, "recipientAccountId": "1111111111111111", "eventCategory":
9797
"Management", "sessionCredentialFromConsole": "true"}'

‎data_sources/aws_cloudtrail_modifyimageattribute.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "
101101
"ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2",
102102
"sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters":
103103
{"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId":
104-
"140429656527"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId":
104+
"1111111111111111"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId":
105105
"84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055",
106106
"eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType":
107107
"AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":

‎data_sources/kubernetes_audit.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ fields:
5454
- user.username
5555
- userAgent
5656
- verb
57-
example_log: '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"582c31ab-4906-49bb-9ff9-872f980ccb84","stage":"ResponseComplete","requestURI":"/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create\u0026fieldValidation=Strict","verb":"create","user":{"username":"k8s-test-user","uid":"aws-iam-authenticator:591511147606:AROAYTOGP2RLFHNBOTP5J","groups":["system:authenticated"]},"sourceIPs":["176.95.188.101"],"userAgent":"kubectl/v1.27.2
57+
example_log: '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"582c31ab-4906-49bb-9ff9-872f980ccb84","stage":"ResponseComplete","requestURI":"/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create\u0026fieldValidation=Strict","verb":"create","user":{"username":"k8s-test-user","uid":"aws-iam-authenticator:111111111111:AROAYTXXXXXXHNXXXXX","groups":["system:authenticated"]},"sourceIPs":["176.95.188.101"],"userAgent":"kubectl/v1.27.2
5858
(darwin/arm64) kubernetes/7f6f68f","objectRef":{"resource":"jobs","namespace":"test2","apiGroup":"batch","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"jobs.batch
5959
is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group
6060
\"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"responseObject":{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"jobs.batch

‎detections/application/detect_distributed_password_spray_attempts.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Distributed Password Spray Attempts
22
id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: Hunting
@@ -65,7 +65,6 @@ tags:
6565
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
6666
mitre_attack_id:
6767
- T1110.003
68-
- T1110
6968
product:
7069
- Splunk Enterprise
7170
- Splunk Enterprise Security

0 commit comments

Comments
 (0)