Added detection testing service results inDetect shared ec2 snapshot

detections/cloud/detect_shared_ec2_snapshot.yml

@@ -5,16 +5,18 @@ date: '2021-07-20'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for AWS CloudTrail events where an EC2 snapshot permissions are modified to be shared with a different AWS account.
-search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL
-| eval match=if(requested_account_id==aws_account_id,"Match","No Match") 
-| table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match"
-  | `detect_shared_ec2_snapshot_filter` '
+description: This search looks for AWS CloudTrail events where an EC2 snapshot permissions
+  are modified to be shared with a different AWS account.
+search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
+  as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
+  Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
+  aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` '
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
-known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
-references: 
-  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+known_false_positives: It is possible that an AWS admin has legitimately shared a
+  snapshot with others for  a specific purpose.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities
@@ -40,14 +42,12 @@ tags:
   - eventName
   - user_arn
   - src_ip
-  - requestParameters.attributeType 
-  - aws_account_id 
-  - vendor_region 
-  - user_agent 
- 
+  - requestParameters.attributeType
+  - aws_account_id
+  - vendor_region
+  - user_agent
   impact: 60
   confidence: 80
-  # (impact * confidence)/100
   risk_score: 48
   context:
   - Source:Cloud Data
@@ -55,7 +55,8 @@ tags:
   - Outcome:Allowed
   - Stage:Execution
   - Stage:Exfiltration
-  message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$
+  message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$
+    by user $user_arn$ from $src_ip$
   observable:
   - name: user_arn
     type: User
@@ -65,4 +66,7 @@ tags:
     type: IP Address
     role:
     - Attacker
-  security_domain: threat
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json