Repository navigation
Conversation
|
@patel-bhavin thanks, fair call — you're right it was firing on any delete_file and leaning on the empty filter macro to do the narrowing. Pushed (22cb9e9): the search logic now does the work. It keys off an editable macro of security-relevant deletion targets (SECURITY.md, audit/access logs, One note on the red unit-testing check: it's the fork-PR Splunkbase-credentials gate — |
|
@eeee2345 Thank you for proposing the fix. We are working on getting unit-testing to work on forks and will merge this MR once that feature has been implemented likely in ESCU 6.3.0 |
|
Apologies regarding this delay but we are still waiting on some tooling updates to have forks tested via our unit-testing pipeline! |
Two TTP detections for the Suspicious MCP Activities story on the mcp:jsonrpc source: - MCP Suspicious File Deletion: delete_file calls whose target matches the editable mcp_security_relevant_deletion_targets macro, or 10 or more deletions from one host. - MCP Webhook Persistence Creation: create_webhook calls to a domain outside the editable mcp_trusted_webhook_domains macro, over plain HTTP, or to a raw IP address.
22cb9e9 to
b57749c
Compare
eeee2345
changed the title
|
@nasbench @patel-bhavin I force-pushed an update. The search logic and macros for the two remaining detections are unchanged from 22cb9e9.
I also updated the PR title and description to match. |
This branch has not been deployed
3 participants
Details
Adds two TTP detections and two supporting macros to the Suspicious MCP Activities story. Both use the existing MCP Server data source (
mcp:jsonrpc), and their unit tests use themcp.logdataset in splunk/attack_data.create_webhookcalls where the destination host is not inmcp_trusted_webhook_domains, the URL uses plain http, or the host is a raw IP address. By default the macro matches nothing, so every new webhook shows up until someone fills it in.delete_filecalls where a deleted path matchesmcp_security_relevant_deletion_targets(SECURITY.md, audit and access logs,.github/and other CI config, key and secret files), or where one host makes 10 or more deletions.An earlier revision also included MCP Source Code Secret Search. I removed it because it overlaps with the
is_secret_huntingbranch of MCP Github Suspicious Operation: same data source, samesearch_codemethod, and six of the same keywords.Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclature. The new files use the samemcp_<short description>naming as the existing detections in this story.mcp.log, not run in Splunk; see below.)Local testing
contentctl-ng buildpasses with contentctl-ng 1.1.1, the version pinned in requirements.txt.scripts/validate_yaml.pyand the pre-commit hooks pass.contentctl-ng testlocally, so I reproduced both searches in Python againstmcp.log. The webhook search matches 5create_webhookevents tohttp://attacker.com/hook. The deletion search matches 5delete_fileevents on SECURITY.md. Each search returns one result row.