name: Abnormally High Number Of Cloud Instances Launched
id: f2361e9f-3928-496c-a556-120cd4223a65
version: 2
date: '2020-08-21'
author: David Dorsey, Splunk
type: batch
datamodel:
- Change
description: This search finds for the number successfully created cloud instances
  for every 4 hour block. This is split up between weekdays and the weekend. It then
  applies the probability densitiy model previously created and alerts on any outliers.
search: '| tstats count as instances_launched values(All_Changes.object_id) as object_id
  from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success
  AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
  <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1]
  | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005
  | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval
  expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) |
  eval distance_from_threshold = instances_launched - expected_upper_threshold | table
  _time, user, instances_launched, expected_upper_threshold, distance_from_threshold,
  object_id | `abnormally_high_number_of_cloud_instances_launched_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
  run the baseline search `Baseline Of Cloud Instances Launched` to create the probability
  density function.
known_false_positives: Many service accounts configured within an AWS infrastructure
  are known to exhibit this behavior. Please adjust the threshold values and filter
  out service accounts from the output. Always verify if this search alerted on a
  human user.
references: []
tags:
  analytic_story:
  - Cloud Cryptomining
  - Suspicious Cloud Instance Activities
  asset_type: Cloud Instance
  cis20:
  - CIS 13
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1078.004
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Security Analytics for AWS
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Changes.object_id
  - All_Changes.action
  - All_Changes.status
  - All_Changes.object_category
  - All_Changes.user
  risk_object: user
  risk_object_type: user
  risk_score: 40
  security_domain: Cloud
