Merge pull request #2318 from splunk/TR_2329_AWS_Credential_Access

Add AWS Credential Access detections

detections/cloud/aws_credential_access_failed_login.yml

@@ -0,0 +1,60 @@
+name: AWS Credential Access Failed Login
+id: a19b354d-0d7f-47f3-8ea6-1a7c36434968
+version: 1
+date: '2022-08-07'
+author: Gowthamaraj Rajendran, Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Authentication
+description: It shows that there have been an unsuccessful attempt to log in using the user identity to the AWS management console. 
+  Since the user identity has access to AWS account services and resources, an attacker might try to brute force the password for that identity.
+search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure Authentication.app=AwsConsoleSignIn Authentication.signature=ConsoleLogin BY Authentication.app Authentication.signature Authentication.dest  Authentication.user Authentication.action Authentication.user_id Authentication.src | `drop_dm_object_name(Authentication)`  | `security_content_ctime(firstTime)`|  `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+known_false_positives: Users may genuinely mistype or forget the password.
+references:
+- https://attack.mitre.org/techniques/T1110/001/
+tags:
+  analytic_story:
+  - AWS Credential Access
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $user$ has a login failure from IP $src$
+  mitre_attack_id:
+  - T1110.001
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - app
+  - eventSource
+  - action
+  - signature
+  - dest
+  - user
+  - user_id
+  risk_score: 49
+  security_domain: threat

detections/cloud/aws_credential_access_getpassworddata.yml

@@ -0,0 +1,60 @@
+name: AWS Credential Access GetPasswordData
+id: 4d347c4a-306e-41db-8d10-b46baf71b3e2
+version: 1
+date: '2022-08-10'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance.
+search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com |  bin _time span=5m |  stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time 
+|  where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment. 
+known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.
+references:
+- https://attack.mitre.org/techniques/T1552/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
+tags:
+  analytic_story:
+  - AWS Credential Access
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$
+  mitre_attack_id:
+  - T1552
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - userIdentity.userName
+  - userAgent
+  - userIdentity.accountId
+  - sourceIPAddress
+  - awsRegion
+  risk_score: 49
+  security_domain: threat

detections/cloud/aws_credential_access_rds_password_reset.yml

@@ -0,0 +1,57 @@
+name: AWS Credential Access RDS Password reset
+id: 6153c5ea-ed30-4878-81e6-21ecdb198189
+version: 1
+date: '2022-08-07'
+author: Gowthamaraj Rajendran, Splunk
+type: TTP
+datamodel: []
+description: The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. Using this technique, the attacker can get access to the
+  sensitive data from the DB. Usually, the production databases may have sensitive data like Credit card information, PII, Health care Data. This event should be 
+  investigated further.
+search: '`cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=* | stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as DB by sourceIPAddress awsRegion eventName userAgent| `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `aws_credential_access_rds_password_reset_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+known_false_positives:  Users may genuinely reset the RDS password.
+references:
+- https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
+tags:
+  analytic_story:
+  - AWS Credential Access
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events.json
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: $DB$ password has been reset from IP $sourceIPAddress$
+  mitre_attack_id:
+  - T1110.002
+  nist:
+  - DE.CM
+  observable:
+  - name: sourceIPAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - requestParameters.dBInstanceIdentifier
+  - userAgent
+  - sourceIPAddress
+  - awsRegion
+  risk_score: 49
+  security_domain: threat

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -32,6 +32,7 @@ references: []
 tags:
   analytic_story:
   - Suspicious Cloud Authentication Activities
+  - AWS Credential Access
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
+  - AWS Credential Access
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
+  - AWS Credential Access
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
+  - AWS Credential Access
   asset_type: AWS Instance
   cis20:
   - CIS 16

stories/aws_credential_access.yml

@@ -0,0 +1,18 @@
+name: AWS Credential Access
+id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9
+version: 1
+date: '2022-08-19'
+author: Gowthamaraj Rajendran, Bhavin Patel,  Splunk
+description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.
+narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities.
+references:
+- https://attack.mitre.org/tactics/TA0006/
+tags:
+  analytic_story: AWS Credential Access
+  category:
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

tests/cloud/aws_credential_access_failed_login.test.yml

@@ -0,0 +1,13 @@
+name: AWS Credential Access Failed Login Unit Test
+tests:
+- name: AWS Credential Access Failed Login
+  file: cloud/aws_credential_access_failed_login.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true

tests/cloud/aws_credential_access_getpassworddata.test.yml

@@ -0,0 +1,13 @@
+name: AWS Credential Access GetPasswordData Unit Test
+tests:
+- name: AWS Credential Access GetPasswordData
+  file: cloud/aws_credential_access_getpassworddata.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true

tests/cloud/aws_credential_access_rds_password_reset.test.yml

@@ -0,0 +1,13 @@
+name: AWS Credential Access RDS Password reset Unit Test
+tests:
+- name: AWS Credential Access RDS Password reset
+  file: cloud/aws_credential_access_rds_password_reset.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true