name: Cloud Compute Instance Created By Previously Unseen User
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
version: 1
date: '2020-08-21'
author: Rico Valdez, Splunk
type: batch
datamodel:
- Change
description: This search looks for cloud compute instances created by users who have
  not created them before.
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
  latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change
  where All_Changes.action=created by All_Changes.user All_Changes.vendor_region |
  `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_compute_creations_by_user
  user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data)
  as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen)
  | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
  | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)`
  | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
  Run the "Previously Seen Cloud Compute Creations By User" support search to create
  of baseline of previously seen users.
known_false_positives: It's possible that a user will start to create compute instances
  for the first time, for any number of reasons. Verify with the user launching instances
  that this is the intended behavior.
references: []
tags:
  analytic_story:
  - Cloud Cryptomining
  asset_type: Cloud Compute Instance
  automated_detection_testing: passed
  cis20:
  - CIS 1
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
  mitre_attack_id:
  - T1078.004
  nist:
  - ID.AM
  product:
  - Splunk Security Analytics for AWS
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Changes.object
  - All_Changes.action
  - All_Changes.user
  - All_Changes.vendor_region
  risk_object: user
  risk_object_type: user
  risk_score: 20
  security_domain: endpoint
