Merge pull request #140 from Korving-F/NixKerberos

Adds Kerberos related Filerules
SnaffCon · Mar 11, 2024 · 23e96df · 23e96df
2 parents 19f0cbd + 087d64b
commit 23e96df
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/...ltRules/FileRules/Keep/Infrastructure/NixKerberos/KeepKerberosCredentialsByExtension.toml b/...ltRules/FileRules/Keep/Infrastructure/NixKerberos/KeepKerberosCredentialsByExtension.toml
@@ -0,0 +1,12 @@
+[[ClassifierRules]]
+EnumerationScope = "FileEnumeration"
+RuleName = "KeepKerberosCredentialsByExtension"
+MatchAction = "Snaffle"
+Description = "Files with these extensions are interesting."
+MatchLocation = "FileExtension"
+WordListType = "Exact"
+MatchLength = 0
+WordList = [
+"\\.keytab",
+"\\.CCACHE"]
+Triage = "Yellow"
diff --git a/...DefaultRules/FileRules/Keep/Infrastructure/NixKerberos/KeepKerberosCredentialsByName.toml b/...DefaultRules/FileRules/Keep/Infrastructure/NixKerberos/KeepKerberosCredentialsByName.toml
@@ -0,0 +1,11 @@
+[[ClassifierRules]]
+EnumerationScope = "FileEnumeration"
+RuleName = "KeepKerberosCredentialsByName"
+MatchAction = "Snaffle"
+Description = "Files with these names are interesting."
+MatchLocation = "FileName"
+WordListType = "Regex"
+MatchLength = 0
+WordList = [
+"krb5cc_.*"]
+Triage = "Yellow"