Merge pull request #149 from ian-barbour/TTX-AndromedaGales

SOSS Community Day NA 2024
ossf · May 2, 2024 · 27c30fc · 27c30fc
2 parents f480983 + 2c0ef72
commit 27c30fc
Show file tree

Hide file tree

Showing 41 changed files with 684 additions and 653 deletions.
diff --git a/docs/TTX/Andromeda_Gales/Andromeda_Synthetic_Event_Logs.zip b/docs/TTX/Andromeda_Gales/Andromeda_Synthetic_Event_Logs.zip
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/10_Env_Enumeration.log b/docs/TTX/Andromeda_Gales/Event_Logs/10_Env_Enumeration.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/11_Establish_Comms.log b/docs/TTX/Andromeda_Gales/Event_Logs/11_Establish_Comms.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/12_C2_Commands.log b/docs/TTX/Andromeda_Gales/Event_Logs/12_C2_Commands.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/15_Network_Boundary_Bridging_VPCFlow.log b/docs/TTX/Andromeda_Gales/Event_Logs/15_Network_Boundary_Bridging_VPCFlow.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/1_DockerHub.log b/docs/TTX/Andromeda_Gales/Event_Logs/1_DockerHub.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/24_Transmission_to_External_C2_Server_VPCFlow.log b/docs/TTX/Andromeda_Gales/Event_Logs/24_Transmission_to_External_C2_Server_VPCFlow.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/2_Artifactory_Sync.log b/docs/TTX/Andromeda_Gales/Event_Logs/2_Artifactory_Sync.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/3_Image_Signing.log b/docs/TTX/Andromeda_Gales/Event_Logs/3_Image_Signing.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/4_Build_Execution.log b/docs/TTX/Andromeda_Gales/Event_Logs/4_Build_Execution.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/5_Build_Persistence.log b/docs/TTX/Andromeda_Gales/Event_Logs/5_Build_Persistence.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/6_Artifactory_Prod_Image.log b/docs/TTX/Andromeda_Gales/Event_Logs/6_Artifactory_Prod_Image.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/7_Discovery_Check_Against_Security_Software_Prisma.log b/docs/TTX/Andromeda_Gales/Event_Logs/7_Discovery_Check_Against_Security_Software_Prisma.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/8_Env_Keying_Prisma.log b/docs/TTX/Andromeda_Gales/Event_Logs/8_Env_Keying_Prisma.log
diff --git a/docs/TTX/Andromeda_Gales/Event_Logs/9_Persistence_Jobs_Prisma.log b/docs/TTX/Andromeda_Gales/Event_Logs/9_Persistence_Jobs_Prisma.log
diff --git a/docs/TTX/Andromeda_Gales/readme.md b/docs/TTX/Andromeda_Gales/readme.md
diff --git a/...it_Log_for_Encoded_Command_Execution.yaml → ...it_Log_for_Encoded_Command_Execution.yaml b/...it_Log_for_Encoded_Command_Execution.yaml → ...it_Log_for_Encoded_Command_Execution.yaml
@@ -1,23 +1,23 @@
-kind: Event
-apiVersion: audit.k8s.io/v1
-level: RequestResponse
-timestamp: "2024-02-29T21:00:00Z"
-auditID: a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6
-stage: ResponseComplete
-requestURI: "/api/v1/namespaces/default/pods/andromeda-web-app-container/exec"
-verb: create
-user:
-  username: system:serviceaccount:default:andromeda-service-account
-  uid: "123456"
-  groups:
-  - system:serviceaccounts
-  - system:serviceaccounts:default
-  - system:authenticated
-sourceIPs: ["192.0.2.123"]
-responseObject:
-  status: "Success"
-  reason: "Executed Encoded Command"
-annotations:
-  kubernetes.io/encoded-command: "[Redacted for Security]"
-  authorization.k8s.io/decision: "allow"
+kind: Event
+apiVersion: audit.k8s.io/v1
+level: RequestResponse
+timestamp: "2024-02-29T21:00:00Z"
+auditID: a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6
+stage: ResponseComplete
+requestURI: "/api/v1/namespaces/default/pods/andromeda-web-app-container/exec"
+verb: create
+user:
+  username: system:serviceaccount:default:andromeda-service-account
+  uid: "123456"
+  groups:
+  - system:serviceaccounts
+  - system:serviceaccounts:default
+  - system:authenticated
+sourceIPs: ["192.0.2.123"]
+responseObject:
+  status: "Success"
+  reason: "Executed Encoded Command"
+annotations:
+  kubernetes.io/encoded-command: "[Redacted for Security]"
+  authorization.k8s.io/decision: "allow"
   authorization.k8s.io/reason: "RBAC: allowed by RoleBinding andromeda-rb/default to ServiceAccount andromeda-service-account"
diff --git a/...4_C2_Traffic_Masquerading_CloudWatch.json → ...4_C2_Traffic_Masquerading_CloudWatch.json b/...4_C2_Traffic_Masquerading_CloudWatch.json → ...4_C2_Traffic_Masquerading_CloudWatch.json
@@ -1,23 +1,23 @@
-{
-  "timestamp": "2024-02-29T21:05:00Z",
-  "logStream": "AndromedaWebCluster/andromeda-web-app-container",
-  "message": "Outbound connection attempt to masqueraded C2 hostname detected. Hostname matches internal service, but DNS resolution history is suspicious. Protocol pattern mimics legitimate service traffic, indicating potential obfuscation efforts.",
-  "kubernetes": {
-    "cluster": "AndromedaWebCluster",
-    "namespace": "default",
-    "pod": "andromeda-web-app-container",
-    "container": "andromeda-web-app"
-  },
-  "network": {
-    "destinationHostname": "internal-service.companydomain.com",
-    "resolvedIP": "malicious[.]ip[.]address",
-    "protocol": "HTTPS",
-    "action": "OutboundConnectionAttempt",
-    "outcome": "Success"
-  },
-  "threat": {
-    "indicator": "C2TrafficMasquerading",
-    "level": "High",
-    "response": "AlertGenerated"
-  }
+{
+  "timestamp": "2024-02-29T21:05:00Z",
+  "logStream": "AndromedaWebCluster/andromeda-web-app-container",
+  "message": "Outbound connection attempt to masqueraded C2 hostname detected. Hostname matches internal service, but DNS resolution history is suspicious. Protocol pattern mimics legitimate service traffic, indicating potential obfuscation efforts.",
+  "kubernetes": {
+    "cluster": "AndromedaWebCluster",
+    "namespace": "default",
+    "pod": "andromeda-web-app-container",
+    "container": "andromeda-web-app"
+  },
+  "network": {
+    "destinationHostname": "internal-service.companydomain.com",
+    "resolvedIP": "malicious[.]ip[.]address",
+    "protocol": "HTTPS",
+    "action": "OutboundConnectionAttempt",
+    "outcome": "Success"
+  },
+  "threat": {
+    "indicator": "C2TrafficMasquerading",
+    "level": "High",
+    "response": "AlertGenerated"
+  }
 }
diff --git a/...Logs/15_Network_Boundary_Bridging_K8.yaml → ...Logs/15_Network_Boundary_Bridging_K8.yaml b/...Logs/15_Network_Boundary_Bridging_K8.yaml → ...Logs/15_Network_Boundary_Bridging_K8.yaml
@@ -1,18 +1,18 @@
-kind: Event
-apiVersion: audit.k8s.io/v1
-level: RequestResponse
-timestamp: "2024-02-29T22:30:00Z"
-auditID: d7e8f9g0-h1i2-j3k4-l5m6-n7o8p9q0r1s2
-stage: ResponseComplete
-requestURI: "/apis/networking.k8s.io/v1/namespaces/default/networkpolicies"
-verb: "list"
-user:
-  username: "system:serviceaccount:default:andromeda-service-account"
-sourceIPs: ["10.244.2.2"]
-responseObject:
-  kind: NetworkPolicyList
-  apiVersion: networking.k8s.io/v1
-annotations:
-  kubernetes.io/network-boundary-bridging: "Attempted enumeration of network policies to identify zero-trust boundary weaknesses."
-responseStatus:
+kind: Event
+apiVersion: audit.k8s.io/v1
+level: RequestResponse
+timestamp: "2024-02-29T22:30:00Z"
+auditID: d7e8f9g0-h1i2-j3k4-l5m6-n7o8p9q0r1s2
+stage: ResponseComplete
+requestURI: "/apis/networking.k8s.io/v1/namespaces/default/networkpolicies"
+verb: "list"
+user:
+  username: "system:serviceaccount:default:andromeda-service-account"
+sourceIPs: ["10.244.2.2"]
+responseObject:
+  kind: NetworkPolicyList
+  apiVersion: networking.k8s.io/v1
+annotations:
+  kubernetes.io/network-boundary-bridging: "Attempted enumeration of network policies to identify zero-trust boundary weaknesses."
+responseStatus:
   code: 200
diff --git a/...e_Roles_and_Policies_Exploitation_K8.yaml → ...e_Roles_and_Policies_Exploitation_K8.yaml b/...e_Roles_and_Policies_Exploitation_K8.yaml → ...e_Roles_and_Policies_Exploitation_K8.yaml
@@ -1,15 +1,15 @@
-kind: Event
-apiVersion: audit.k8s.io/v1
-level: Metadata
-timestamp: "2024-02-29T22:40:00Z"
-auditID: u1v2w3x4-y5z6-a7b8-c9d0-e1f2g3h4i5j6
-stage: ResponseComplete
-requestURI: "/apis/rbac.authorization.k8s.io/v1/namespaces/default/roles"
-verb: "list"
-user:
-  username: "system:serviceaccount:default:andromeda-service-account"
-sourceIPs: ["10.244.2.3"]
-annotations:
-  kubernetes.io/role-exploitation: "Listed roles in the default namespace to find overly permissive configurations for privilege escalation."
-responseStatus:
+kind: Event
+apiVersion: audit.k8s.io/v1
+level: Metadata
+timestamp: "2024-02-29T22:40:00Z"
+auditID: u1v2w3x4-y5z6-a7b8-c9d0-e1f2g3h4i5j6
+stage: ResponseComplete
+requestURI: "/apis/rbac.authorization.k8s.io/v1/namespaces/default/roles"
+verb: "list"
+user:
+  username: "system:serviceaccount:default:andromeda-service-account"
+sourceIPs: ["10.244.2.3"]
+annotations:
+  kubernetes.io/role-exploitation: "Listed roles in the default namespace to find overly permissive configurations for privilege escalation."
+responseStatus:
   code: 200