detkit-cli 0.1.1__tar.gz → 0.1.3__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- detkit_cli-0.1.3/.github/workflows/ci.yml +21 -0
- detkit_cli-0.1.3/.github/workflows/publish.yml +34 -0
- detkit_cli-0.1.3/.gitignore +9 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/PKG-INFO +1 -1
- detkit_cli-0.1.3/action.yml +27 -0
- detkit_cli-0.1.3/detkit/__init__.py +6 -0
- detkit_cli-0.1.3/detkit-demo.gif +0 -0
- detkit_cli-0.1.3/detkit-demo.tape +51 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit_cli.egg-info/PKG-INFO +1 -1
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit_cli.egg-info/SOURCES.txt +10 -0
- detkit_cli-0.1.3/detkit_cli.egg-info/scm_file_list.json +20 -0
- detkit_cli-0.1.3/detkit_cli.egg-info/scm_version.json +8 -0
- detkit_cli-0.1.3/examples/rules/whoami_execution.test.yml +23 -0
- detkit_cli-0.1.3/examples/rules/whoami_execution.yml +15 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/pyproject.toml +38 -36
- detkit_cli-0.1.1/detkit/__init__.py +0 -1
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/LICENSE +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/README.md +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit/__main__.py +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit/cli.py +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit/evaluator.py +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit_cli.egg-info/dependency_links.txt +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit_cli.egg-info/entry_points.txt +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit_cli.egg-info/requires.txt +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/detkit_cli.egg-info/top_level.txt +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/setup.cfg +0 -0
- {detkit_cli-0.1.1 → detkit_cli-0.1.3}/tests/test_evaluator.py +0 -0
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
on: [push, pull_request]
|
|
3
|
+
|
|
4
|
+
jobs:
|
|
5
|
+
test:
|
|
6
|
+
runs-on: ubuntu-latest
|
|
7
|
+
strategy:
|
|
8
|
+
matrix:
|
|
9
|
+
python-version: ['3.9', '3.12']
|
|
10
|
+
steps:
|
|
11
|
+
- uses: actions/checkout@v4
|
|
12
|
+
with:
|
|
13
|
+
fetch-depth: 0
|
|
14
|
+
- uses: actions/setup-python@v5
|
|
15
|
+
with:
|
|
16
|
+
python-version: ${{ matrix.python-version }}
|
|
17
|
+
- run: pip install -e .
|
|
18
|
+
- name: Unit checks (evaluator core)
|
|
19
|
+
run: python tests/test_evaluator.py
|
|
20
|
+
- name: Example rules must pass their tests
|
|
21
|
+
run: detkit test examples/rules
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
name: Publish to PyPI
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
on:
|
|
5
|
+
release:
|
|
6
|
+
types: [published]
|
|
7
|
+
|
|
8
|
+
jobs:
|
|
9
|
+
publish:
|
|
10
|
+
runs-on: ubuntu-latest
|
|
11
|
+
environment: pypi
|
|
12
|
+
permissions:
|
|
13
|
+
id-token: write
|
|
14
|
+
steps:
|
|
15
|
+
- uses: actions/checkout@v4
|
|
16
|
+
with:
|
|
17
|
+
fetch-depth: 0
|
|
18
|
+
- uses: actions/setup-python@v5
|
|
19
|
+
with:
|
|
20
|
+
python-version: '3.x'
|
|
21
|
+
|
|
22
|
+
- name: Build
|
|
23
|
+
run: |
|
|
24
|
+
pip install build
|
|
25
|
+
python -m build
|
|
26
|
+
|
|
27
|
+
- name: Don't ship a broken build
|
|
28
|
+
run: |
|
|
29
|
+
pip install dist/*.whl
|
|
30
|
+
python tests/test_evaluator.py
|
|
31
|
+
detkit test examples/rules
|
|
32
|
+
|
|
33
|
+
- name: Publish to PyPI
|
|
34
|
+
uses: pypa/gh-action-pypi-publish@release/v1
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
name: 'detkit — test detections'
|
|
2
|
+
description: 'Run detkit against your Sigma detection rules to gate pull requests in CI.'
|
|
3
|
+
branding:
|
|
4
|
+
icon: 'shield'
|
|
5
|
+
color: 'purple'
|
|
6
|
+
inputs:
|
|
7
|
+
path:
|
|
8
|
+
description: 'Directory containing your Sigma rules and their *.test.yml files.'
|
|
9
|
+
required: false
|
|
10
|
+
default: '.'
|
|
11
|
+
command:
|
|
12
|
+
description: 'Which detkit command to run: test or validate.'
|
|
13
|
+
required: false
|
|
14
|
+
default: 'test'
|
|
15
|
+
runs:
|
|
16
|
+
using: 'composite'
|
|
17
|
+
steps:
|
|
18
|
+
- name: Set up Python
|
|
19
|
+
uses: actions/setup-python@v5
|
|
20
|
+
with:
|
|
21
|
+
python-version: '3.11'
|
|
22
|
+
- name: Install detkit
|
|
23
|
+
shell: bash
|
|
24
|
+
run: pip install "${{ github.action_path }}"
|
|
25
|
+
- name: Run detkit
|
|
26
|
+
shell: bash
|
|
27
|
+
run: detkit "${{ inputs.command }}" "${{ inputs.path }}"
|
|
Binary file
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# detkit demo — generate the GIF with: vhs detkit-demo.tape
|
|
2
|
+
# Prereqs: `go install github.com/charmbracelet/vhs@latest` (or brew install vhs),
|
|
3
|
+
# run from the detkit repo root, and `pip install -e .` first.
|
|
4
|
+
# Uses GNU sed (Linux/WSL). On macOS, change `sed -i` to `sed -i ''`.
|
|
5
|
+
|
|
6
|
+
Output detkit-demo.gif
|
|
7
|
+
|
|
8
|
+
Require detkit
|
|
9
|
+
|
|
10
|
+
Set Shell bash
|
|
11
|
+
Set Theme "Dracula"
|
|
12
|
+
Set FontSize 18
|
|
13
|
+
Set Width 1200
|
|
14
|
+
Set Height 680
|
|
15
|
+
Set Padding 24
|
|
16
|
+
Set TypingSpeed 45ms
|
|
17
|
+
|
|
18
|
+
Hide
|
|
19
|
+
Type "clear"
|
|
20
|
+
Enter
|
|
21
|
+
Show
|
|
22
|
+
|
|
23
|
+
Type "# A Sigma rule ships with sample events saying what it should catch:"
|
|
24
|
+
Enter
|
|
25
|
+
Sleep 1s
|
|
26
|
+
Type "detkit test examples/rules"
|
|
27
|
+
Enter
|
|
28
|
+
Sleep 3s
|
|
29
|
+
|
|
30
|
+
Type "# A teammate 'tidies up' the rule and quietly breaks the detection..."
|
|
31
|
+
Enter
|
|
32
|
+
Sleep 1s
|
|
33
|
+
Type "sed -i 's/whoami/whoamiXYZ/' examples/rules/whoami_execution.yml"
|
|
34
|
+
Enter
|
|
35
|
+
Sleep 1200ms
|
|
36
|
+
|
|
37
|
+
Type "# detkit catches it. Non-zero exit means CI blocks the pull request:"
|
|
38
|
+
Enter
|
|
39
|
+
Sleep 800ms
|
|
40
|
+
Type "detkit test examples/rules; echo exit=$?"
|
|
41
|
+
Enter
|
|
42
|
+
Sleep 4s
|
|
43
|
+
|
|
44
|
+
Type "# Revert -> green again."
|
|
45
|
+
Enter
|
|
46
|
+
Sleep 800ms
|
|
47
|
+
Type "sed -i 's/whoamiXYZ/whoami/' examples/rules/whoami_execution.yml"
|
|
48
|
+
Enter
|
|
49
|
+
Type "detkit test examples/rules; echo exit=$?"
|
|
50
|
+
Enter
|
|
51
|
+
Sleep 3500ms
|
|
@@ -1,6 +1,12 @@
|
|
|
1
|
+
.gitignore
|
|
1
2
|
LICENSE
|
|
2
3
|
README.md
|
|
4
|
+
action.yml
|
|
5
|
+
detkit-demo.gif
|
|
6
|
+
detkit-demo.tape
|
|
3
7
|
pyproject.toml
|
|
8
|
+
.github/workflows/ci.yml
|
|
9
|
+
.github/workflows/publish.yml
|
|
4
10
|
detkit/__init__.py
|
|
5
11
|
detkit/__main__.py
|
|
6
12
|
detkit/cli.py
|
|
@@ -10,5 +16,9 @@ detkit_cli.egg-info/SOURCES.txt
|
|
|
10
16
|
detkit_cli.egg-info/dependency_links.txt
|
|
11
17
|
detkit_cli.egg-info/entry_points.txt
|
|
12
18
|
detkit_cli.egg-info/requires.txt
|
|
19
|
+
detkit_cli.egg-info/scm_file_list.json
|
|
20
|
+
detkit_cli.egg-info/scm_version.json
|
|
13
21
|
detkit_cli.egg-info/top_level.txt
|
|
22
|
+
examples/rules/whoami_execution.test.yml
|
|
23
|
+
examples/rules/whoami_execution.yml
|
|
14
24
|
tests/test_evaluator.py
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
{
|
|
2
|
+
"files": [
|
|
3
|
+
".gitignore",
|
|
4
|
+
"detkit-demo.tape",
|
|
5
|
+
"README.md",
|
|
6
|
+
"action.yml",
|
|
7
|
+
"pyproject.toml",
|
|
8
|
+
"detkit-demo.gif",
|
|
9
|
+
"LICENSE",
|
|
10
|
+
".github/workflows/publish.yml",
|
|
11
|
+
".github/workflows/ci.yml",
|
|
12
|
+
"examples/rules/whoami_execution.yml",
|
|
13
|
+
"examples/rules/whoami_execution.test.yml",
|
|
14
|
+
"detkit/evaluator.py",
|
|
15
|
+
"detkit/__main__.py",
|
|
16
|
+
"detkit/cli.py",
|
|
17
|
+
"detkit/__init__.py",
|
|
18
|
+
"tests/test_evaluator.py"
|
|
19
|
+
]
|
|
20
|
+
}
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
# Unit tests for whoami_execution.yml
|
|
2
|
+
# every detection ships with sample events proving it fires (and doesn't).
|
|
3
|
+
tests:
|
|
4
|
+
- name: fires on whoami run by a normal user
|
|
5
|
+
event:
|
|
6
|
+
EventID: 4688
|
|
7
|
+
CommandLine: "cmd /c whoami /all"
|
|
8
|
+
User: "alice"
|
|
9
|
+
expect: match
|
|
10
|
+
|
|
11
|
+
- name: suppressed for SYSTEM (the filter)
|
|
12
|
+
event:
|
|
13
|
+
EventID: 4688
|
|
14
|
+
CommandLine: "whoami"
|
|
15
|
+
User: "SYSTEM"
|
|
16
|
+
expect: no_match
|
|
17
|
+
|
|
18
|
+
- name: no match on an unrelated command
|
|
19
|
+
event:
|
|
20
|
+
EventID: 4688
|
|
21
|
+
CommandLine: "ipconfig /all"
|
|
22
|
+
User: "alice"
|
|
23
|
+
expect: no_match
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
title: Whoami Execution
|
|
2
|
+
id: 6f0c3f2e-2a5e-4a1e-9b3a-0d5f1a2b3c4d
|
|
3
|
+
status: experimental
|
|
4
|
+
description: Detects execution of whoami.exe, common in post-exploitation recon.
|
|
5
|
+
logsource:
|
|
6
|
+
category: process_creation
|
|
7
|
+
product: windows
|
|
8
|
+
detection:
|
|
9
|
+
selection:
|
|
10
|
+
EventID: 4688
|
|
11
|
+
CommandLine|contains: 'whoami'
|
|
12
|
+
filter:
|
|
13
|
+
User: 'SYSTEM'
|
|
14
|
+
condition: selection and not filter
|
|
15
|
+
level: low
|
|
@@ -1,36 +1,38 @@
|
|
|
1
|
-
[project]
|
|
2
|
-
name = "detkit-cli"
|
|
3
|
-
|
|
4
|
-
description = "dbt for detections — test, validate, and CI-gate Sigma detection rules as code."
|
|
5
|
-
readme = "README.md"
|
|
6
|
-
requires-python = ">=3.9"
|
|
7
|
-
license = { text = "MIT" }
|
|
8
|
-
authors = [{ name = "detkit" }]
|
|
9
|
-
keywords = [
|
|
10
|
-
"sigma", "detection-engineering", "detection-as-code",
|
|
11
|
-
"siem", "security", "detections", "blue-team", "cybersecurity",
|
|
12
|
-
]
|
|
13
|
-
classifiers = [
|
|
14
|
-
"Development Status :: 3 - Alpha",
|
|
15
|
-
"Intended Audience :: Information Technology",
|
|
16
|
-
"Topic :: Security",
|
|
17
|
-
"License :: OSI Approved :: MIT License",
|
|
18
|
-
"Programming Language :: Python :: 3",
|
|
19
|
-
"Operating System :: OS Independent",
|
|
20
|
-
]
|
|
21
|
-
dependencies = ["pyyaml>=6"]
|
|
22
|
-
|
|
23
|
-
[project.urls]
|
|
24
|
-
Homepage = "https://github.com/ELSATOAH/detkit"
|
|
25
|
-
Repository = "https://github.com/ELSATOAH/detkit"
|
|
26
|
-
Issues = "https://github.com/ELSATOAH/detkit/issues"
|
|
27
|
-
|
|
28
|
-
[project.scripts]
|
|
29
|
-
detkit = "detkit.cli:main"
|
|
30
|
-
|
|
31
|
-
[build-system]
|
|
32
|
-
requires = ["setuptools>=61"]
|
|
33
|
-
build-backend = "setuptools.build_meta"
|
|
34
|
-
|
|
35
|
-
[tool.setuptools.packages.find]
|
|
36
|
-
include = ["detkit*"]
|
|
1
|
+
[project]
|
|
2
|
+
name = "detkit-cli"
|
|
3
|
+
dynamic = ["version"]
|
|
4
|
+
description = "dbt for detections — test, validate, and CI-gate Sigma detection rules as code."
|
|
5
|
+
readme = "README.md"
|
|
6
|
+
requires-python = ">=3.9"
|
|
7
|
+
license = { text = "MIT" }
|
|
8
|
+
authors = [{ name = "detkit" }]
|
|
9
|
+
keywords = [
|
|
10
|
+
"sigma", "detection-engineering", "detection-as-code",
|
|
11
|
+
"siem", "security", "detections", "blue-team", "cybersecurity",
|
|
12
|
+
]
|
|
13
|
+
classifiers = [
|
|
14
|
+
"Development Status :: 3 - Alpha",
|
|
15
|
+
"Intended Audience :: Information Technology",
|
|
16
|
+
"Topic :: Security",
|
|
17
|
+
"License :: OSI Approved :: MIT License",
|
|
18
|
+
"Programming Language :: Python :: 3",
|
|
19
|
+
"Operating System :: OS Independent",
|
|
20
|
+
]
|
|
21
|
+
dependencies = ["pyyaml>=6"]
|
|
22
|
+
|
|
23
|
+
[project.urls]
|
|
24
|
+
Homepage = "https://github.com/ELSATOAH/detkit"
|
|
25
|
+
Repository = "https://github.com/ELSATOAH/detkit"
|
|
26
|
+
Issues = "https://github.com/ELSATOAH/detkit/issues"
|
|
27
|
+
|
|
28
|
+
[project.scripts]
|
|
29
|
+
detkit = "detkit.cli:main"
|
|
30
|
+
|
|
31
|
+
[build-system]
|
|
32
|
+
requires = ["setuptools>=61", "setuptools-scm>=8"]
|
|
33
|
+
build-backend = "setuptools.build_meta"
|
|
34
|
+
|
|
35
|
+
[tool.setuptools.packages.find]
|
|
36
|
+
include = ["detkit*"]
|
|
37
|
+
|
|
38
|
+
[tool.setuptools_scm]
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
__version__ = "0.1.0"
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|