Releases · panther-labs/panther-analysis

28 Nov 22:12

panther-bot-automation

v3.26.0

137d2a8

v3.26.0

What's Changed

🏡 Miscellaneous

Add threat research team to CODEOWNERS by @egibs in #963
Update standard_ruleset.yml to include Notion Data Model by @LCMeed in #961
Update github_secret_scanning_alert_created rule/tests by @egibs in #962
Snowflake Kubernetes Inital Detection Drop by @sfc-gh-kderevyanik in #965
Enable Dependabot for GitHub actions by @wadells in #968
build(deps): bump actions/checkout from 3 to 4 by @dependabot in #969
build(deps): bump peterjgrainger/action-create-branch from 2.3.0 to 2.4.0 by @dependabot in #970
build(deps): bump actions/github-script from 6 to 7 by @dependabot in #971
Teleport: Update Rules by @jof in #966
Carbonblack passthrough rule by @arielkr256 in #967
Add rule to detect AWSCompromisedKeyQuarantineV2 policy attachments by @egibs in #964
k8s pack by @arielkr256 in #974
Renamed default rule to avoid by @arielkr256 in #975
k8s queries disabled by default by @arielkr256 in #976
Update CRYPTO_MINING_DOMAINS IOCs; add two additional tests by @egibs in #973
Checkout repository with GITHUB_TOKEN by @egibs in #977
Add rule to alert on known cryptomining ports in VPC flow logs by @egibs in #972
Revert "Add rule to alert on known cryptomining ports in VPC flow logs" by @egibs in #978

New Contributors

@sfc-gh-kderevyanik made their first contribution in #965
@jof made their first contribution in #966

Full Changelog: v3.25.0...v3.26.0

Contributors

jof, wadells, and 5 other contributors

Assets 4

21 Nov 19:54

panther-bot-automation

v3.25.0

1e33659

v3.25.0

What's Changed

🏡 Miscellaneous

Update release Workflow by @egibs in #946
Fix zeek mappings for greynoise riot basic lut by @rleighton in #945
Update License in README by @le4ker in #948
added dynamic severity function and MITRE tags by @arielkr256 in #947
Add EXCLUDED_BUCKET_NAMES set for aws_cloudtrail_s3_bucket_public.py policy by @egibs in #951
Adds a check for messages in the response by @grantjoy in #944
fix selector syntax by @nskobov in #952
remove deprecated azure.signin related detections by @nskobov in #953
Add GCP SSO persistence rules by @egibs in #954
Carbonblack audit rules, part 1 by @arielkr256 in #956
Update PAT to 0.33.0 by @egibs in #957
Update release Workflow with GITHUB_TOKEN env var by @egibs in #958
Update gh release create command by @egibs in #959
Use --generate-notes for release creation by @egibs in #960

Full Changelog: v3.24.0...v3.25.0

Contributors

le4ker, grantjoy, and 4 other contributors

Assets 4

14 Nov 00:22

egibs

v3.24.0

48cf45e

v3.24.0

What's Changed

🏡 Miscellaneous

adding optional TEST_ARGS to the test targets by @rootshellz in #935
added MITRE ATT&CK tags to all Slack rules by @arielkr256 in #933
Set git_config_pull_rebase: true for fork sync step by @egibs in #936
Auto deploy on Wednesday mornings by @grantjoy in #934
Updating panther_user_modified to use default severity by @stedrow in #938
bump shallow_since from 1 month to 5 years to look back to the beginning of git history by @grantjoy in #937
fix path to CODEOWNERS by @grantjoy in #940
Add Workflow to automate panther-analysis releases by @egibs in #939
removing shallow_since by @grantjoy in #941
Add Pull config by @egibs in #942
Creating common ancestor commit by @egibs in #943

New Contributors

@rootshellz made their first contribution in #935
@stedrow made their first contribution in #938

Full Changelog: v3.22.0...v3.24.0

Contributors

rootshellz, grantjoy, and 3 other contributors

Assets 4

07 Nov 21:37

egibs

v3.22.0

00f3fbf

v3.22.0

What's Changed

🏡 Miscellaneous

gcp_k8s_rules: fix logic matching irrelevant events by @cheahjs in #928
Always use the "our" CODEOWNERS by @grantjoy in #927
ID to Name path change zendesk_data_model.yml by @JPhenglavong in #929
AWS CloudTrail Password Discovery detection by @natezpanther in #628
Fix the Zeek selectors in luts by @rleighton in #930
updated title to use profileId if no email by @arielkr256 in #931
Update aws_unauthorized_api_call dedup function by @egibs in #932

New Contributors

@cheahjs made their first contribution in #928
@JPhenglavong made their first contribution in #929

Full Changelog: v3.21.0...v3.22.0

Contributors

cheahjs, grantjoy, and 5 other contributors

Assets 4

02 Nov 16:19

egibs

v3.21.0

64351c5

v3.21.0

What's Changed

🏡 Miscellaneous

kbailey: rule for phished okta session by @k-bailey in #500
build(deps): bump requests from 2.28.1 to 2.31.0 by @dependabot in #923
build(deps): bump urllib3 from 1.26.12 to 1.26.18 by @dependabot in #922
Move from AGPL to Apache Software License by @egibs in #924
Update sync-from-upstream.yml GH action from 'master' to 'main' by @AndrewMohawk in #925
Remove PAT clone from lint-test Workflow by @egibs in #926

New Contributors

@AndrewMohawk made their first contribution in #925

Full Changelog: v3.20.0...v3.21.0

Contributors

AndrewMohawk, k-bailey, and 2 other contributors

Assets 4

31 Oct 19:02

egibs

v3.20.0

596cbc1

v3.20.0

What's Changed

🕵️ New Detections

Tines Rule - Story Jobs Clearance by @josh-panther in #800

🏡 Miscellaneous

added test case for user modified by System by @arielkr256 in #910
Expanded Microsoft365.Exchange.External.Forwarding to work with ForwardingAddress property by @ben-githubs in #909
Fix Standard.ImpossibleTravel.Login by @corrylc in #912
added default strings to deep_walks by @arielkr256 in #913
update upstream branch in README by @le4ker in #914
fixed severity issue for Super admin granted by @arielkr256 in #917
Template: example_scheduled_query update by @nkulig in #689
Set severity to INFO if making calendar private by @apanzerj in #904
saved search for IOCs published by Okta by @arielkr256 in #916
build(deps-dev): bump werkzeug from 3.0.0 to 3.0.1 by @dependabot in #911
Up-to-date implementation of #868 by @egibs in #918
Update global-helpers-unit-test call syntax by @wadells in #903
Add a helper to retrieve the AWS account ID associated with a given access key ID by @egibs in #920