Better Public IP Recognition #1150
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
😱 [ERROR][root]: There are packs that are potentially missing detections: gcp_audit.yml: GCP.IAM.serviceAccounts.signJwt.Privilege.Escalation,GCP.compute.instances.create.Privilege.Escalation
<!-- thollander/actions-comment-pull-request "check-packs" --> |
egibs
added a commit
that referenced
this pull request
Mar 18, 2024
Co-authored-by: Evan Gibler <evan.gibler@panther.com>
arielkr256
added a commit
that referenced
this pull request
Mar 19, 2024
* Fixed IndexOutOfRange error in get_zoom_usergroup_context (#1141) * Use correct key when retrieving string_set in Okta Stolen Session Rule (#1142) * Fix key when retrieving string_set in Okta Stolen Session Rule * fmt * rolling back changes related to simple_rules dir (#1143) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * typo fix: gcp_privilege_escalation_by_deploymants (#1140) * Update PAT to 0.42.0 (#1145) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * converted is_private to not is_global (#1150) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * Rework base64 recognition to use python functions rather than regex (#1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64() * renames .yaml files to .yml (#1151) * THREAT-241 Several GCP rules with NoneType errors --------- Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: kjihso <133820431+kjihso@users.noreply.github.com> Co-authored-by: darwayne <darwaynelynch@gmail.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com>
egibs
added a commit
that referenced
this pull request
Mar 19, 2024
* converted is_private to not is_global (#1150) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * Rework base64 recognition to use python functions rather than regex (#1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64() * renames .yaml files to .yml (#1151) * THREAT-240 GCP compute.instance.create AttributeError (#1152) * Add GCP.IAM.serviceAccounts.getAccessToken.Privilege.Escalation rule (#1149) * Add GCP.IAM.serviceAccounts.getAccessToken.Privilege.Escalation rule * Add GCP.IAM.serviceAccounts.signBlob rule * Lolbas tuning (#1147) * lower severity and set disabled false * lower severity and disable * Update PAT to 0.43.0 (#1154) * fix - Several GCP rules with NoneType errors (#1155) * Fixed IndexOutOfRange error in get_zoom_usergroup_context (#1141) * Use correct key when retrieving string_set in Okta Stolen Session Rule (#1142) * Fix key when retrieving string_set in Okta Stolen Session Rule * fmt * rolling back changes related to simple_rules dir (#1143) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * typo fix: gcp_privilege_escalation_by_deploymants (#1140) * Update PAT to 0.42.0 (#1145) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * converted is_private to not is_global (#1150) Co-authored-by: Evan Gibler <evan.gibler@panther.com> * Rework base64 recognition to use python functions rather than regex (#1146) * base64 rules use python funtions not regex * better alertcontext for standard_dns_base64 * command line tools as global var * regex and length checks for edge cases * new global_helper for is_base64() * renames .yaml files to .yml (#1151) * THREAT-241 Several GCP rules with NoneType errors --------- Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: Evan Gibler <evan.gibler@panther.com> Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: kjihso <133820431+kjihso@users.noreply.github.com> Co-authored-by: darwayne <darwaynelynch@gmail.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> --------- Co-authored-by: Ariel Ropek <79653153+arielkr256@users.noreply.github.com> Co-authored-by: Panos Sakkos <panos.sakkos@panther.com> Co-authored-by: akozlovets098 <95437895+akozlovets098@users.noreply.github.com> Co-authored-by: Oleh Melenevskyi <767472+melenevskyi@users.noreply.github.com> Co-authored-by: kjihso <133820431+kjihso@users.noreply.github.com> Co-authored-by: darwayne <darwaynelynch@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
Python's
ipaddress.is_privatefunction considers the 100.64.0.0/10 network to be public, while theipaddress.is_globalfunction says that it is not. Theis_globalfunction is more in line with the IANA IPv4 Special-Purpose Address Registry: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtmlChanges
Testing