Dlux 3 - New & Updated AD / GPO / ACL Detections

[dluxtron]

Lots of new detections focused on Active Directory.

ACL Abuse, GPO Modifications & other AD persistence vectors.

New lookups created to support resolving guids & making sense of the ACEs.

[dluxtron]

Need to upload SA-admon to the S3 bucket
https://splunkbase.splunk.com/app/6853

https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_110.tgz

[patel-bhavin]

Need to upload SA-admon to the S3 bucket https://splunkbase.splunk.com/app/6853

https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_110.tgz

Looks like we will need to updated contentctl code create an exception for this. Its likely not to do with attack range code

[patel-bhavin]

@dluxtron : Thank you for the PR : A couple of things before we get this shipped

• Looks like attack_data is not present for a few detections. Can you submit those?
• Lets we improve the text in the description, how to implement, known false positives.

Here's the screenshot of unit testing failures

[patel-bhavin]

Need to upload SA-admon to the S3 bucket https://splunkbase.splunk.com/app/6853
https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_110.tgz

Looks like we will need to updated contentctl code create an exception for this. Its likely not to do with attack range code

DOne: https://github.com/splunk/contentctl/releases/tag/v4.2.2

[patel-bhavin]

@dluxtron : Thanks for contributing the updated datasets and fixing up this PR! I believe this PR is more or less ready to go! I made some minor updates to this PR! Amazing contribution, yet again :)