Skip to content

Commit b6a28b6

Browse files
author
Patrick Bareiss
committed
Merge branch 'develop' into github_detections_improvement
2 parents eead81f + 93f33cc commit b6a28b6

File tree

259 files changed

+492
-330
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

259 files changed

+492
-330
lines changed

‎.github/workflows/appinspect.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,13 @@ jobs:
1818

1919
- name: Install Python Dependencies and ContentCTL and Atomic Red Team
2020
run: |
21-
pip install contentctl==5.0.0
21+
if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
22+
echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
23+
pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
24+
else
25+
echo "Installing latest contentctl version"
26+
pip install contentctl
27+
fi
2228
git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
2329
git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
2430

‎.github/workflows/build.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,13 @@ jobs:
1919

2020
- name: Install Python Dependencies and ContentCTL and Atomic Red Team
2121
run: |
22-
pip install contentctl==5.0.0
22+
if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
23+
echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
24+
pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
25+
else
26+
echo "Installing latest contentctl version"
27+
pip install contentctl
28+
fi
2329
git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
2430
git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
2531

‎.github/workflows/unit-testing.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,13 @@ jobs:
2323
- name: Install Python Dependencies and ContentCTL
2424
run: |
2525
python -m pip install --upgrade pip
26-
pip install contentctl==5.0.0
26+
if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
27+
echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
28+
pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
29+
else
30+
echo "Installing latest contentctl version"
31+
pip install contentctl
32+
fi
2733
2834
# Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop
2935
# Make sure we check out the PR, even if it actually lives in a fork

‎contentctl.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@ apps:
7171
- uid: 833
7272
title: Splunk Add-on for Unix and Linux
7373
appid: Splunk_TA_nix
74-
version: 9.2.0
74+
version: 10.0.0
7575
description: description of app
76-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_920.tgz
76+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_1000.tgz
7777
- uid: 5579
7878
title: Splunk Add-on for CrowdStrike FDR
7979
appid: Splunk_TA_CrowdStrike_FDR

‎data_sources/linux_auditd_add_user.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux
1212
url: https://splunkbase.splunk.com/app/833
13-
version: 9.2.0
13+
version: 10.0.0
1414
fields:
1515
- msg
1616
- type
@@ -30,4 +30,6 @@ fields:
3030
- UID
3131
- AUID
3232
- ID
33-
example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"'
33+
example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000
34+
ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1
35+
addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"'

‎data_sources/linux_auditd_execve.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux
1212
url: https://splunkbase.splunk.com/app/833
13-
version: 9.2.0
13+
version: 10.0.0
1414
fields:
1515
- msg
1616
- type
1717
- msg
1818
- argc
19-
example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"'
19+
example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so"
20+
a2="./prog"'

‎data_sources/linux_auditd_path.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux
1212
url: https://splunkbase.splunk.com/app/833
13-
version: 9.2.0
13+
version: 10.0.0
1414
fields:
1515
- msg
1616
- type
@@ -30,4 +30,6 @@ fields:
3030
- cap_frootid
3131
- OUID
3232
- OGID
33-
example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'
33+
example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~"
34+
inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0
35+
cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"'

‎data_sources/linux_auditd_proctitle.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux
1212
url: https://splunkbase.splunk.com/app/833
13-
version: 9.2.0
13+
version: 10.0.0
1414
fields:
1515
- proctitle
1616
- msg

‎data_sources/linux_auditd_service_stop.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux
1212
url: https://splunkbase.splunk.com/app/833
13-
version: 9.2.0
13+
version: 10.0.0
1414
fields:
1515
- msg
1616
- type
@@ -28,4 +28,6 @@ fields:
2828
- res
2929
- UID
3030
- AUID
31-
example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"'
31+
example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295
32+
ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd"
33+
hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"'

‎data_sources/linux_auditd_syscall.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux
1212
url: https://splunkbase.splunk.com/app/833
13-
version: 9.2.0
13+
version: 10.0.0
1414
fields:
1515
- msg
1616
- type
@@ -20,7 +20,7 @@ fields:
2020
- success
2121
- exit
2222
- a1
23-
- a2
23+
- a2
2424
- a3
2525
- items
2626
- ppid
@@ -51,4 +51,9 @@ fields:
5151
- EGID
5252
- SGID
5353
- FSGID
54-
example_log: 'type=SYSCALL msg=audit(1723035666.627:3663): arch=c000003e syscall=59 success=yes exit=0 a0=556a6d697a58 a1=556a6d68ad00 a2=556a6d69c980 a3=0 items=2 ppid=1300 pid=1301 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="lsmod" exe="/usr/bin/kmod" subj=unconfined key="rootcmd" ARCH=x86_64 SYSCALL=execve AUID="ubuntu" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"'
54+
example_log: 'type=SYSCALL msg=audit(1723035666.627:3663): arch=c000003e syscall=59
55+
success=yes exit=0 a0=556a6d697a58 a1=556a6d68ad00 a2=556a6d69c980 a3=0 items=2
56+
ppid=1300 pid=1301 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
57+
tty=pts1 ses=1 comm="lsmod" exe="/usr/bin/kmod" subj=unconfined key="rootcmd" ARCH=x86_64
58+
SYSCALL=execve AUID="ubuntu" UID="root" GID="root" EUID="root" SUID="root" FSUID="root"
59+
EGID="root" SGID="root" FSGID="root"'

0 commit comments

Comments
 (0)