Rework base64 recognition to use python functions rather than regex #1146
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
😱 [ERROR][root]: There are packs that are potentially missing detections: gcp_audit.yml: GCP.compute.instances.create.Privilege.Escalation,GCP.IAM.serviceAccounts.signJwt.Privilege.Escalation
<!-- thollander/actions-comment-pull-request "check-packs" --> |
|
This new method also has the added benefit of being able to return the decoded string. |
jacknagz
reviewed
Mar 12, 2024
egibs
pushed a commit
that referenced
this pull request
Mar 18, 2024
…1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64()
arielkr256
added a commit
that referenced
this pull request
Mar 19, 2024
* Fixed IndexOutOfRange error in get_zoom_usergroup_context (#1141) * Use correct key when retrieving string_set in Okta Stolen Session Rule (#1142) * Fix key when retrieving string_set in Okta Stolen Session Rule * fmt * rolling back changes related to simple_rules dir (#1143) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * typo fix: gcp_privilege_escalation_by_deploymants (#1140) * Update PAT to 0.42.0 (#1145) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * converted is_private to not is_global (#1150) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * Rework base64 recognition to use python functions rather than regex (#1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64() * renames .yaml files to .yml (#1151) * THREAT-241 Several GCP rules with NoneType errors --------- Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: kjihso <133820431+kjihso@users.noreply.github.com> Co-authored-by: darwayne <darwaynelynch@gmail.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com>
egibs
added a commit
that referenced
this pull request
Mar 19, 2024
* converted is_private to not is_global (#1150) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * Rework base64 recognition to use python functions rather than regex (#1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64() * renames .yaml files to .yml (#1151) * THREAT-240 GCP compute.instance.create AttributeError (#1152) * Add GCP.IAM.serviceAccounts.getAccessToken.Privilege.Escalation rule (#1149) * Add GCP.IAM.serviceAccounts.getAccessToken.Privilege.Escalation rule * Add GCP.IAM.serviceAccounts.signBlob rule * Lolbas tuning (#1147) * lower severity and set disabled false * lower severity and disable * Update PAT to 0.43.0 (#1154) * fix - Several GCP rules with NoneType errors (#1155) * Fixed IndexOutOfRange error in get_zoom_usergroup_context (#1141) * Use correct key when retrieving string_set in Okta Stolen Session Rule (#1142) * Fix key when retrieving string_set in Okta Stolen Session Rule * fmt * rolling back changes related to simple_rules dir (#1143) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * typo fix: gcp_privilege_escalation_by_deploymants (#1140) * Update PAT to 0.42.0 (#1145) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * converted is_private to not is_global (#1150) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * Rework base64 recognition to use python functions rather than regex (#1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64() * renames .yaml files to .yml (#1151) * THREAT-241 Several GCP rules with NoneType errors --------- Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: kjihso <133820431+kjihso@users.noreply.github.com> Co-authored-by: darwayne <darwaynelynch@gmail.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: akozlovets098 <95437895+akozlovets098@users.noreply.github.com> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: kjihso <133820431+kjihso@users.noreply.github.com> Co-authored-by: darwayne <darwaynelynch@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
Regex for matching base64 encoded commands and domains was causing false positives because they were matching any ASCII word whose length was a multiple of 4. These are technically valid base64 encodings, but cannot be converted back into ASCII strings. This PR switches from regex to
b64decode(arg).decode("ascii")which will throw an error if the base64 string cannot be converted into an ASCII string.Changes
Testing