Repository navigation
Conversation
|
@patel-bhavin thanks, fair call — you're right it was firing on any delete_file and leaning on the empty filter macro to do the narrowing. Pushed (22cb9e9): the search logic now does the work. It keys off an editable macro of security-relevant deletion targets (SECURITY.md, audit/access logs, One note on the red unit-testing check: it's the fork-PR Splunkbase-credentials gate — |
|
@eeee2345 Thank you for proposing the fix. We are working on getting unit-testing to work on forks and will merge this MR once that feature has been implemented likely in ESCU 6.3.0 |
|
Apologies regarding this delay but we are still waiting on some tooling updates to have forks tested via our unit-testing pipeline! |
22cb9e9 to
b57749c
Compare
eeee2345
changed the title
|
@nasbench @patel-bhavin I force-pushed an update. The search logic and macros for the two remaining detections are unchanged from 22cb9e9.
I also updated the PR title and description to match. |
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b57749c1ff
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | eval webhook_url='params.url' | ||
| | eval target_repo='params.repo' | ||
| | eval target_owner='params.owner' | ||
| | rex field=webhook_url "^(?<url_scheme>https?)://(?<webhook_host>[^/:]+)" |
There was a problem hiding this comment.
Once mcp_trusted_webhook_domains is populated, a valid HTTPS URL such as https://hooks.example.com:x@evil.test/hook is sent to evil.test because the prefix is URL userinfo, but this rex stops at the first colon and records hooks.example.com as webhook_host. An exact allowlist entry then sets is_trusted_domain=1, while both risk flags remain 0, so the where at line 22 drops this attacker-controlled webhook; parse the authority's host after userinfo (or reject userinfo) before applying the allowlist.
Useful? React with 👍 / 👎.
| modification_date: '2026-06-29' | ||
| author: Adam Lin | ||
| description: Editable regular expression of security-relevant deletion targets used by the MCP Suspicious File Deletion detection to narrow file deletions to data-destruction and defense-evasion candidates. Matches security policy files (SECURITY.md), audit and log paths, CI and workflow configuration under .github/, infrastructure-as-code and pipeline definitions, and common security control files. Edit this macro to add or remove paths that are security-relevant in your environment. | ||
| definition: '"(?i)(^|/)(security\.md|codeowners|\.github/|\.gitlab-ci\.yml|\.circleci/|jenkinsfile|\.pre-commit-config\.yaml|dependabot\.ya?ml)|(^|/)(audit|access|secure|auth|security)[^/]*\.log$|(^|/)(audit|logs?|var/log|history)/|\.(pem|key|crt|p12|pfx|kdbx)$|(^|/)(\.env|secrets?\.ya?ml|credentials|\.aws/|\.ssh/|known_hosts|authorized_keys)"' |
There was a problem hiding this comment.
For MCP events from Windows—the source definition itself shows a backslash-delimited path at data_sources/mcp_server.yml:178—this regex only recognizes ^ or / before target names and only / inside directory patterns. A deletion such as C:\repo\SECURITY.md or C:\repo\.github\workflows\ci.yml therefore leaves is_security_relevant=0 and is suppressed unless ten deletions happen in the same search window; normalize separators or include backslashes in the boundary patterns.
Useful? React with 👍 / 👎.
Two TTP detections for the Suspicious MCP Activities story on the mcp:jsonrpc source: - MCP Suspicious File Deletion: delete_file calls whose target matches the editable mcp_security_relevant_deletion_targets macro, or 10 or more deletions from one host. - MCP Webhook Persistence Creation: create_webhook calls to a domain outside the editable mcp_trusted_webhook_domains macro, over plain HTTP, or to a raw IP address.
|
@nasbench I addressed both Codex findings in a separate commit on top, rebased onto current develop.
The events in the |
b57749c to
b54a292
Compare
Details
Adds two TTP detections and two supporting macros to the Suspicious MCP Activities story. Both use the existing MCP Server data source (
mcp:jsonrpc), and their unit tests use themcp.logdataset in splunk/attack_data.create_webhookcalls where the destination host is not inmcp_trusted_webhook_domains, the URL uses plain http, or the host is a raw IP address. By default the macro matches nothing, so every new webhook shows up until someone fills it in.delete_filecalls where a deleted path matchesmcp_security_relevant_deletion_targets(SECURITY.md, audit and access logs,.github/and other CI config, key and secret files), or where one host makes 10 or more deletions.An earlier revision also included MCP Source Code Secret Search. I removed it because it overlaps with the
is_secret_huntingbranch of MCP Github Suspicious Operation: same data source, samesearch_codemethod, and six of the same keywords.Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclature. The new files use the samemcp_<short description>naming as the existing detections in this story.mcp.log, not run in Splunk; see below.)Local testing
contentctl-ng buildpasses with contentctl-ng 1.1.1, the version pinned in requirements.txt.scripts/validate_yaml.pyand the pre-commit hooks pass.contentctl-ng testlocally, so I reproduced both searches in Python againstmcp.log. The webhook search matches 5create_webhookevents tohttp://attacker.com/hook. The deletion search matches 5delete_fileevents on SECURITY.md. Each search returns one result row.