From b11c7f7a26f11b21f5c169ccab2f2234e4ac756a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 17 May 2023 15:05:01 -0700 Subject: [PATCH 1/2] referenfce and test update --- .../cloud/aws_disable_bucket_versioning.yml | 1 + .../aws_exfiltration_via_batch_service.yml | 1 + .../aws_exfiltration_via_datasync_task.yml | 1 + .../aws_exfiltration_via_ec2_snapshot.yml | 2 ++ stories/data_exfiltration.yml | 24 ++++++++++--------- 5 files changed, 18 insertions(+), 11 deletions(-) diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml index f173606b91..86e4274e3a 100644 --- a/detections/cloud/aws_disable_bucket_versioning.yml +++ b/detections/cloud/aws_disable_bucket_versioning.yml @@ -14,6 +14,7 @@ how_to_implement: You must install splunk AWS add on and Splunk App for AWS. Thi known_false_positives: It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs. references: - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82 +- https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436 tags: analytic_story: - Suspicious AWS S3 Activities diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml index 0131d71200..a82ad0634f 100644 --- a/detections/cloud/aws_exfiltration_via_batch_service.yml +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -13,6 +13,7 @@ how_to_implement: You must install splunk AWS add on and Splunk App for AWS. Thi known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. references: - https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ +- https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436 tags: analytic_story: - Data Exfiltration diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml index 99a57afc1c..a216d1cc8e 100644 --- a/detections/cloud/aws_exfiltration_via_datasync_task.yml +++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml @@ -13,6 +13,7 @@ how_to_implement: You must install splunk AWS add on and Splunk App for AWS. Thi known_false_positives: It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task references: - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://www.shehackske.com/how-to/data-exfiltration-on-cloud-1606/ tags: analytic_story: - Suspicious AWS S3 Activities diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml index 6a5bb174d4..ce77625e43 100644 --- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -14,6 +14,8 @@ known_false_positives: It is possible that an AWS admin has legitimately shared references: - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html +- https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436 +- https://stratus-red-team.cloud/attack-techniques/list/ tags: analytic_story: - Suspicious Cloud Instance Activities diff --git a/stories/data_exfiltration.yml b/stories/data_exfiltration.yml index 7ec73a9280..b28284d99b 100644 --- a/stories/data_exfiltration.yml +++ b/stories/data_exfiltration.yml @@ -1,17 +1,19 @@ name: Data Exfiltration id: 66b0fe0c-1351-11eb-adc1-0242ac120002 -version: 1 -date: '2020-10-21' -author: Shannon Davis, Splunk -description: The stealing of data by an adversary. -narrative: Exfiltration comes in many flavors. Adversaries can collect data over - encrypted or non-encrypted channels. They can utilise Command And Control channels - that are already in place to exfiltrate data. They can use both standard data transfer - protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard - protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent - security technologies in place. +version: 2 +date: '2023-05-17' +author: Bhavin Patel, Shannon Davis, Splunk +description: Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets. + +narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumventsecurity technologies in place.\ + + Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. In context of the cloud, this refers to the unauthorized transfer or extraction of sensitive data from cloud-based systems or services. It involves the compromise of cloud infrastructure or accounts to gain access to valuable information stored in the cloud environment. Attackers may employ various techniques, such as exploiting vulnerabilities, stealing login credentials, or using malicious code to exfiltrate data from cloud repositories or services without detection. + references: - https://attack.mitre.org/tactics/TA0010/ +- https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436 +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a tags: analytic_story: Data Exfiltration category: @@ -20,4 +22,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection + usecase: Advanced Threat Detection \ No newline at end of file From caf380edb4b879bc14d4e3c0937081f934a6c55d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 25 May 2023 16:17:47 -0700 Subject: [PATCH 2/2] Update data_exfiltration.yml Just adding a missing space in description field. --- stories/data_exfiltration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/data_exfiltration.yml b/stories/data_exfiltration.yml index b28284d99b..8ea7011468 100644 --- a/stories/data_exfiltration.yml +++ b/stories/data_exfiltration.yml @@ -5,7 +5,7 @@ date: '2023-05-17' author: Bhavin Patel, Shannon Davis, Splunk description: Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets. -narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumventsecurity technologies in place.\ +narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.\ Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. In context of the cloud, this refers to the unauthorized transfer or extraction of sensitive data from cloud-based systems or services. It involves the compromise of cloud infrastructure or accounts to gain access to valuable information stored in the cloud environment. Attackers may employ various techniques, such as exploiting vulnerabilities, stealing login credentials, or using malicious code to exfiltrate data from cloud repositories or services without detection. @@ -22,4 +22,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection