Branch was auto-updated.

detections/cloud/aws_ecr_container_upload_unknown_user.yml

@@ -0,0 +1,63 @@
+name: AWS ECR Container Upload Unknown User
+id: 300688e4-365c-4486-a065-7c884462b31d
+version: 1
+date: '2021-08-19'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container
+  Service (ECR). A upload of a new container is normally done from only a few known users.
+  When the user was never seen before, we should have a closer look into the event.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
+  | rename requestParameters.* as *
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, 
+  userName, src_ip, imageTag, registryId, repositoryName
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_upload_unknown_user_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1204/003/
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Container uploaded from unknown user $user$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - eventSource
+  - eventName
+  - awsRegion
+  - requestParameters.imageTag
+  - requestParameters.registryId
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
+  risk_score: 49
+  security_domain: network

macros/aws_ecr_users.yml

@@ -0,0 +1,3 @@
+definition: userName IN (user)
+description: specify the user allowed to push Images to AWS ECR.
+name: aws_ecr_users

tests/cloud/aws_ecr_container_upload_unknown_user.test.yml

@@ -0,0 +1,12 @@
+name: AWS ECR Container Upload Unknown User Unit Test
+tests:
+- name: AWS ECR Container Upload Unknown User
+  file: cloud/aws_ecr_container_upload_unknown_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_container_upload.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail