name: Cloud Provisioning Activity From Previously Unseen Country
id: 94994255-3acf-4213-9b3f-0494df03bb31
version: 1
date: '2020-10-09'
author: Rico Valdez, Bhavin Patel, Splunk
type: batch
datamodel:
- Change
description: This search looks for cloud provisioning activities from previously unseen
  countries. Provisioning activities are defined broadly as any event that runs or
  creates something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
  | lookup previously_seen_cloud_provisioning_activity_sources Country as Country
  OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
  where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
  OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
  Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
  | `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
  provider.  You should run the baseline search `Previously Seen Cloud Provisioning
  Activity Sources - Initial` to build the initial table of source IP address, geographic
  locations, and times. You must also enable the second baseline search `Previously
  Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date
  and to age out old data. You can adjust the time window for this search by updating
  the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
  additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter`
  macro.
known_false_positives: "This is a strictly behavioral search, so we define \"false\
  \ positive\" slightly differently. Every time this fires, it will accurately reflect\
  \ the first occurrence in the time period you're searching within, plus what is\
  \ stored in the cache feature. But while there are really no \"false positives\"\
  \ in a traditional sense, there is definitely lots of noise.\\\n This search will\
  \ fire any time a new IP address is seen in the **GeoIP** database for any kind\
  \ of provisioning activity. If you typically do all provisioning from tools inside\
  \ of your country, there should be few false positives. If you are located in countries\
  \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
  \ has weak resolution (particularly small countries in less economically powerful\
  \ regions), this may be much less valuable to you."
references: []
tags:
  analytic_story:
  - Suspicious Cloud Provisioning Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
  cis20:
  - CIS 1
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
  mitre_attack_id:
  - T1078
  nist:
  - ID.AM
  product:
  - Splunk Security Analytics for AWS
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Changes.action
  - All_Changes.status
  - All_Changes.src
  - All_Changes.user
  - All_Changes.object
  - All_Changes.command
  risk_object: user
  risk_object_type: user
  risk_score: 5
  security_domain: endpoint
