Circle CI Disable Security Step
THIS IS A EXPERIMENTAL DETECTION
This detection has been marked experimental by the Splunk Threat Research team. This means we have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is NOT supported.
Description
The following analytic detects the disablement of security steps in a CircleCI pipeline. Addressing instances of security step disablement in CircleCI pipelines can mitigate the risks associated with potential security vulnerabilities and unauthorized changes. A proactive approach helps protect the organization's infrastructure, data, and overall security posture. The detection is made by a Splunk query that searches for specific criteria within CircleCI logs through a combination of field renaming, joining, and statistical analysis to identify instances where security steps are disabled. It retrieves information such as job IDs, job names, commit details, and user information from the CircleCI logs. The detection is important because it indicates potential security vulnerabilities or unauthorized changes to the pipeline caused by someone within the organization intentionally or unintentionally disabling security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline and the associated infrastructure exposed to potential attacks, data breaches, or the introduction of malicious code into the pipeline. Investigate by reviewing the job name, commit details, and user information associated with the disablement of security steps. You must also examine any relevant on-disk artifacts and identify concurrent processes that might indicate the source of the attack or unauthorized change.
- Type: Anomaly
-
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2021-09-01
- Author: Patrick Bareiss, Splunk
- ID: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
Annotations
Kill Chain Phase
- Installation
NIST
- DE.AE
CIS20
- CIS 13
CVE
Search
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
`circleci`
| rename workflows.job_id AS job_id
| join job_id [
| search `circleci`
| stats values(name) as step_names count by job_id job_name ]
| stats count by step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{}
| rename vcs.* as * , owners{} as user
| lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step
| search mandatory_step=*
| eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0)
| where mandatory_step_executed=0
| rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
| eval phase="build"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `circle_ci_disable_security_step_filter`
Macros
The SPL above uses the following Macros:
circle_ci_disable_security_step_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Lookups
The SPL above uses the following Lookups:
Required fields
List of fields required to use this analytic.
- _times
How To Implement
You must index CircleCI logs.
Known False Positives
unknown
Associated Analytic Story
RBA
Risk Score | Impact | Confidence | Message |
---|---|---|---|
72.0 | 80 | 90 | Disable security step $mandatory_step$ in job $job_name$ from user $user$ |
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
Reference
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
source | version: 1