Merge pull request #1338 from panther-labs/release

Prepare for `v3.62.0`
panther-labs · Aug 27, 2024 · 428e614 · 428e614
2 parents dca7bc6 + a4aed26
commit 428e614
Show file tree

Hide file tree

Showing 84 changed files with 3,117 additions and 1,087 deletions.
diff --git a/Pipfile b/Pipfile
@@ -19,7 +19,7 @@ wrapt = "~=1.15"
 [packages]
 policyuniverse = "==1.5.1.20230817"
 requests = "==2.31.0"
-panther-analysis-tool = "~=0.51"
+panther-analysis-tool = "~=0.52.1"
 panther-detection-helpers = "==0.4.0"
 
 [requires]

diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/correlation_rules/aws_potentially_compromised_service_role_cr.yml b/correlation_rules/aws_potentially_compromised_service_role_cr.yml
@@ -8,7 +8,7 @@ Tags:
 Severity: Info
 Reports:
   MITRE ATT&CK:
-    - T1528 # Steal Application Access Token
+    - TA0006:T1528 # Steal Application Access Token
 Description: A role was assumed by an AWS service, followed by a user within 24 hours.  This could indicate a stolen or compromised AWS service role.
 Detection:
   - Sequence:

diff --git a/correlation_rules/aws_privilege_escalation_via_user_compromise.yml b/correlation_rules/aws_privilege_escalation_via_user_compromise.yml
@@ -5,7 +5,7 @@ Enabled: true
 Severity: Medium
 Reports:
   MITRE ATT&CK:
-    - T1098.001 # Additional Cloud Credentials
+    - TA0004:T1098.001 # Additional Cloud Credentials
 Detection:
     - Sequence:
         - ID: User Backdoored

diff --git a/correlation_rules/aws_user_takeover_via_password_reset.yml b/correlation_rules/aws_user_takeover_via_password_reset.yml
@@ -5,7 +5,7 @@ Enabled: true
 Severity: High
 Reports:
   MITRE ATT&CK:
-    - T1098.001 # Additional Cloud Credentials
+    - TA0004:T1098.001 # Additional Cloud Credentials
 Detection:
     - Sequence:
         - ID: Password Reset

diff --git a/correlation_rules/okta_login_without_push.yml b/correlation_rules/okta_login_without_push.yml
@@ -7,8 +7,8 @@ Tags:
   - Configuration Required
 Reports:
   MITRE ATT&CK:
-    - T1212 # Exploitation for Credential Access
-    - T1539 # Steal Web Session Cookie
+    - TA0006:T1212 # Exploitation for Credential Access
+    - TA0006:T1539 # Steal Web Session Cookie
 Severity: Critical
 Detection:
   - Sequence:

diff --git a/correlation_rules/potential_compromised_okta_credentials.yml b/correlation_rules/potential_compromised_okta_credentials.yml
@@ -7,8 +7,8 @@ Tags:
   - Configuration Required
 Reports:
   MITRE ATT&CK:
-    - T1212 # Exploitation for Credential Access
-    - T1539 # Steal Web Session Cookie
+    - TA0006:T1212 # Exploitation for Credential Access
+    - TA0006:T1539 # Steal Web Session Cookie
 Severity: Critical
 Detection:
   - Sequence:

diff --git a/correlation_rules/secret_exposed_and_not_quarantined.yml b/correlation_rules/secret_exposed_and_not_quarantined.yml
@@ -7,7 +7,7 @@ Tags:
 Severity: High
 Reports:
     MITRE ATT&CK:
-        - T1552.001
+        - TA0006:T1552.001
 Description: The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS.  When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.
 Reference: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
 Detection:

diff --git a/global_helpers/crowdstrike_event_streams_helpers.py b/global_helpers/crowdstrike_event_streams_helpers.py
@@ -2,6 +2,22 @@
 
 
 def cs_alert_context(event):
+    return audit_keys_dict(event)
+
+
+def audit_keys_dict(event):
     return key_value_list_to_dict(
         event.deep_get("event", "AuditKeyValues", default=[]), "Key", "ValueString"
     )
+
+
+def str_to_list(liststr: str) -> list[str]:
+    """Several crowdstrike values are returned as a list like "[x y z]". This function convetrs
+    such entries to Python list of strings, like: ["x", "y", "z"]."""
+    # Return empty list for empty string
+    if not liststr:
+        return []
+    # Validate
+    if liststr[0] != "[" or liststr[-1] != "]":
+        raise ValueError(f"Invalid list string: {liststr}")
+    return [x.strip() for x in liststr[1:-1].split(" ")]
diff --git a/global_helpers/panther_iocs.py b/global_helpers/panther_iocs.py
@@ -1,71 +1,5 @@
 # pylint: disable=line-too-long
 
-# 2022-06-02 Confluence 0-Day IOCs:
-# https://github.com/volexity/threat-intel/blob/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/indicators.csv
-VOLEXITY_CONFLUENCE_IP_IOCS = {
-    "156.146.34.46",
-    "156.146.34.9",
-    "156.146.56.136",
-    "198.147.22.148",
-    "45.43.19.91",
-    "66.115.182.102",
-    "66.115.182.111",
-    "67.149.61.16",
-    "154.16.105.147",
-    "64.64.228.239",
-    "156.146.34.52",
-    "154.146.34.145",
-    "221.178.126.244",
-    "59.163.248.170",
-    "98.32.230.38",
-}
-
-# SUNBURST IOCs:
-# https://github.com/fireeye/sunburst_countermeasures/blob/main/indicator_release/Indicator_Release_NBIs.csv
-# Last accessed: 2021-11-17
-SUNBURST_FQDN_IOCS = {
-    "databasegalore.com",
-    "deftsecurity.com",
-    "freescanonline.com",
-    "highdatabase.com",
-    "incomeupdate.com",
-    "panhardware.com",
-    "thedoccloud.com",
-    "websitetheme.com",
-    "zupertech.com",
-    "6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud.com",
-    "7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud.com",
-    "gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud.com",
-    "ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud.com",
-    "k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud.com",
-    "mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud.com",
-}
-
-SUNBURST_IP_IOCS = {"0.0.0.1"}
-
-# https://github.com/mandiant/sunburst_countermeasures/blob/main/indicator_release/Indicator_Release_Hashes.csv
-# Last accessed: 2021-11-17
-SUNBURST_SHA256_IOCS = {
-    "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134",
-    "292327e5c94afa352cc5a02ca273df543f2020d0e76368ff96c84f4e90778712",
-    "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77",
-    "53f8dfc65169ccda021b72a62e0c22a4db7c4077f002fa742717d41b3c40f2c7",
-    "abe22cf0d78836c3ea072daeaf4c5eeaf9c29b6feb597741651979fc8fbd2417",
-    "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6",
-    "d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600",
-}
-
-# LOG4J IOCs:
-# IPs Pulled from the following sources, deduped and compiled here.
-# https://gist.github.com/gnremy/c546c7911d5f876f263309d7161a7217
-# https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/Log4j_IOC_List.csv
-# https://raw.githubusercontent.com/Malwar3Ninja/Exploitation-of-Log4j2-CVE-2021-44228/main/Threatview.io-log4j2-IOC-list
-# Created 12-13-21
-
-LOG4J_IP_IOCS = {
-    # The rule using this set has been deprecated and disabled by default
-    "0.0.0.1"
-}
 
 # Example sources:
 # - https://www.fastly.com/blog/new-data-and-insights-into-log4shell-attacks-cve-2021-44228

diff --git a/packs/crowdstrike_event_streams.yml b/packs/crowdstrike_event_streams.yml
@@ -3,7 +3,17 @@ PackID: PantherManaged.CrowdstrikeEventStreams
 Description: Group of all Crowdstrike Event Stream detections
 PackDefinition:
   IDs:
+    - crowdstrike_event_streams_helpers
+    - panther_base_helpers
+
+    - Crowdstrike.AdminRoleAssigned
+    - Crowdstrike.AllowlistRemoved
     - Crowdstrike.API.Key.Created
     - Crowdstrike.API.Key.Deleted
-    - panther_base_helpers
-    - crowdstrike_event_streams_helpers
+    - Crowdstrike.EphemeralUserAccount
+    - Crowdstrike.IpAllowlistChanged
+    - Crowdstrike.NewAdminUserCreated
+    - Crowdstrike.NewUserCreated
+    - Crowdstrike.SingleIpAllowlisted
+    - Crowdstrike.UserDeleted
+    - Crowdstrike.UserPasswordChange
diff --git a/packs/github.yml b/packs/github.yml
@@ -14,11 +14,12 @@ PackDefinition:
     - GitHub.Org.Modified
     - Github.Repo.CollaboratorChange
     - Github.Repo.Created
-    - GitHub.Repo.HookModified
+    #- GitHub.Repo.HookModified
     - GitHub.Repo.InitialAccess
     - Github.Repo.VisibilityChange
     - GitHub.Secret.Scanning.Alert.Created
     - GitHub.Team.Modified
+    - GitHub.Webhook.Modified
     - GitHub.User.AccessKeyCreated
     - GitHub.User.RoleUpdated
     - Github.Organization.App.Integration.Installed

diff --git a/packs/log4j.yml b/packs/log4j.yml
diff --git a/queries/aws_queries/aws_potentially_compromised_service_role.yml b/queries/aws_queries/aws_potentially_compromised_service_role.yml
@@ -7,7 +7,7 @@ Tags:
 Severity: High
 Reports:
   MITRE ATT&CK:
-    - T1528 # Steal Application Access Token
+    - TA0006:T1528 # Steal Application Access Token
 Description: A role was assumed by an AWS service, followed by a user within 24 hours.  This could indicate a stolen or compromised AWS service role.
 Filename: scheduled_rule_default.py
 ScheduledQueries:

diff --git a/rules/auth0_rules/auth0_user_invitation_created.yml b/rules/auth0_rules/auth0_user_invitation_created.yml
@@ -4,6 +4,7 @@ Enabled: true
 Filename: auth0_user_invitation_created.py
 Reference: https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members
 Severity: Info
+CreateAlert: false
 Tests:
   - ExpectedResult: true
     Log:

diff --git a/rules/auth0_rules/auth0_user_joined_tenant.yml b/rules/auth0_rules/auth0_user_joined_tenant.yml
@@ -6,6 +6,7 @@ Filename: auth0_user_joined_tenant.py
 RuleID: Auth0.User.Joined.Tenant
 Reference: https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members#send-membership-invitations:~:text=.-,Send%20membership%20invitations,-You%20can
 Severity: Info
+CreateAlert: false
 LogTypes:
   - Auth0.Events
 Tests:

diff --git a/rules/aws_cloudtrail_rules/aws_cloudtrail_account_discovery.yml b/rules/aws_cloudtrail_rules/aws_cloudtrail_account_discovery.yml
@@ -8,6 +8,7 @@ Reports:
   MITRE ATT&CK:
     - TA0007:T1087
 Severity: Info
+CreateAlert: false
 Tests:
   - ExpectedResult: true
     Log:

diff --git a/rules/aws_cloudtrail_rules/aws_ec2_traffic_mirroring.py b/rules/aws_cloudtrail_rules/aws_ec2_traffic_mirroring.py
@@ -12,9 +12,9 @@ def rule(event):
         "DeleteTrafficMirrorFilterRule",
         "DeleteTrafficMirrorSession",
         "DeleteTrafficMirrorTarget",
-        "DescribeTrafficMirrorFilters",
-        "DescribeTrafficMirrorSessions",
-        "DescribeTrafficMirrorTargets",
+        # "DescribeTrafficMirrorFilters",
+        # "DescribeTrafficMirrorSessions",
+        # "DescribeTrafficMirrorTargets",
         "ModifyTrafficMirrorFilterNetworkServices",
         "ModifyTrafficMirrorFilterRule",
         "ModifyTrafficMirrorSession",
@@ -28,9 +28,6 @@ def rule(event):
 
 
 def title(event):
-    # (Optional) Return a string which will be shown as the alert title.
-    # If no 'dedup' function is defined, the return value of this method will
-    # act as deduplication string.
     return (
         f"{event.get('userIdentity',{}).get('arn','no-type')} ec2 activity found for "
         f"{event.get('eventName')} in account {event.get('recipientAccountId')} "
@@ -39,12 +36,8 @@ def title(event):
 
 
 def dedup(event):
-    #  (Optional) Return a string which will be used to deduplicate similar alerts.
-    # Dedupe based on user identity, to not include multiple events from the same identity.
     return f"{event.get('userIdentity',{}).get('arn','no-user-identity-provided')}"
 
 
 def alert_context(event):
-    #  (Optional) Return a dictionary with additional data to be included
-    #  in the alert sent to the SNS/SQS/Webhook destination
     return aws_rule_context(event)
diff --git a/rules/aws_cloudtrail_rules/aws_ec2_traffic_mirroring.yml b/rules/aws_cloudtrail_rules/aws_ec2_traffic_mirroring.yml
@@ -10,6 +10,13 @@ Tags:
   - AWS
   - Cloudtrail
   - MITRE
+DedupPeriodMinutes: 1440
+LogTypes:
+  - AWS.CloudTrail
+RuleID: "AWS.EC2.Traffic.Mirroring"
+SummaryAttributes:
+  - userIdentity.type
+Threshold: 1
 Tests:
   - ExpectedResult: true
     Log:
@@ -341,7 +348,7 @@ Tests:
           webIdFederationData: {}
         type: AssumedRole
     Name: DeleteTrafficMirrorTarget
-  - ExpectedResult: true
+  - ExpectedResult: false
     Log:
       awsRegion: us-east-1
       eventCategory: Management
@@ -553,10 +560,3 @@ Tests:
             "type": "AssumedRole",
           },
       }
-DedupPeriodMinutes: 60
-LogTypes:
-  - AWS.CloudTrail
-RuleID: "AWS.EC2.Traffic.Mirroring"
-SummaryAttributes:
-  - userIdentity.type
-Threshold: 1
diff --git a/rules/aws_cloudtrail_rules/aws_ecr_crud.yml b/rules/aws_cloudtrail_rules/aws_ecr_crud.yml
@@ -14,7 +14,8 @@ Reports:
     - 3.12
   MITRE ATT&CK:
     - TA0005:T1525
-Severity: High
+Severity: Info
+CreateAlert: false
 Description: Unauthorized ECR Create, Read, Update, or Delete event occurred.
 Runbook: https://docs.aws.amazon.com/AmazonECR/latest/userguide/logging-using-cloudtrail.html
 Reference: https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam.html#security_iam_authentication

diff --git a/rules/aws_cloudtrail_rules/aws_ecr_events.yml b/rules/aws_cloudtrail_rules/aws_ecr_events.yml
@@ -12,7 +12,8 @@ Tags:
 Reports:
   MITRE ATT&CK:
     - TA0005:T1535
-Severity: Medium
+Severity: Info
+CreateAlert: false
 Description: An ECR event occurred outside of an expected account or region
 Runbook: https://docs.aws.amazon.com/AmazonECR/latest/userguide/logging-using-cloudtrail.html
 Reference: https://aws.amazon.com/blogs/containers/amazon-ecr-in-multi-account-and-multi-region-architectures/

diff --git a/rules/aws_cloudtrail_rules/aws_iam_group_read_only_events.yml b/rules/aws_cloudtrail_rules/aws_iam_group_read_only_events.yml
@@ -6,6 +6,7 @@ Filename: aws_iam_group_read_only_events.py
 Reference: https://attack.mitre.org/techniques/T1069/
 Runbook: Examine other activities done by this user to determine whether or not activity is suspicious.
 Severity: Info
+CreateAlert: false
 Tags:
   - AWS
   - Cloudtrail

diff --git a/rules/aws_cloudtrail_rules/aws_s3_activity_greynoise.yml b/rules/aws_cloudtrail_rules/aws_s3_activity_greynoise.yml
@@ -8,7 +8,8 @@ Reports:
   MITRE ATT&CK:
     - TA0009:T1530
 Runbook: Investigate all actions taken and validate that the ARN conducting the acitivty was not compromised
-Severity: High
+Severity: Info
+CreateAlert: false
 DedupPeriodMinutes: 60
 Threshold: 1
 SummaryAttributes:

diff --git a/rules/aws_cloudtrail_rules/aws_snapshot_made_public.py b/rules/aws_cloudtrail_rules/aws_snapshot_made_public.py
@@ -3,6 +3,8 @@
 from panther_base_helpers import aws_rule_context, deep_get
 from panther_default import aws_cloudtrail_success
 
+IS_SINGLE_USER_SHARE = False  # Used to adjust severity
+
 
 def rule(event):
     if not aws_cloudtrail_success(event):
@@ -19,11 +21,20 @@ def rule(event):
             if not isinstance(item, (Mapping, dict)):
                 continue
             if item.get("userId") or item.get("group") == "all":
+                global IS_SINGLE_USER_SHARE  # pylint: disable=global-statement
+                IS_SINGLE_USER_SHARE = "userId" in item  # Used for dynamic severity
                 return True
         return False
 
     return False
 
 
+def severity(_):
+    # Set severity to INFO if only shared with a single user
+    if IS_SINGLE_USER_SHARE:
+        return "INFO"
+    return "DEFAULT"
+
+
 def alert_context(event):
     return aws_rule_context(event)