Branch was auto-updated.

detections/application/okta_mfa_exhaustion_hunt.yml

@@ -39,11 +39,11 @@ tags:
   asset_type: Infrastructure
   confidence: 60
   impact: 30
-  message: $src_user$ account has rejected multiple Okta pushes.
+  message: $user$ account has rejected multiple Okta pushes.
   mitre_attack_id:
   - T1110
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Attacker
@@ -53,7 +53,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - src_user
+  - user
   - src_ip
   - eventType
   - status

detections/application/okta_two_or_more_rejected_okta_pushes.yml

@@ -33,11 +33,11 @@ tags:
   asset_type: Infrastructure
   confidence: 80
   impact: 80
-  message: $src_user$ account has rejected multiple Okta pushes.
+  message: $user$ account has rejected multiple Okta pushes.
   mitre_attack_id:
   - T1110
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Attacker
@@ -47,7 +47,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - src_user
+  - user
   - src_ip
   - eventType
   - status

detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml

@@ -30,7 +30,7 @@ tags:
   mitre_attack_id:
     - T1189
   observable:
-    - name: User
+    - name: user
       type: User
       role:
         - Victim

detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml

@@ -36,7 +36,7 @@ tags:
   mitre_attack_id:
   - T1588.004
   observable:
-  - name: Hostname
+  - name: host
     type: Hostname
     role:
     - Victim

detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml

@@ -38,7 +38,7 @@ tags:
   mitre_attack_id:
   - T1588.004
   observable:
-  - name: Hostname
+  - name: host
     type: Hostname
     role:
     - Victim

detections/cloud/aws_exfiltration_via_batch_service.yml

@@ -2,12 +2,12 @@ name: AWS Exfiltration via Batch Service
 id: 04455dd3-ced7-480f-b8e6-5469b99e98e2
 version: 1
 date: '2023-04-24'
-author: ''
+author: Bhavin Patel, Splunk
 status: production
 type: TTP
 data_source: []
 description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. 
-search: '`cloudtrail` eventName = JobCreated |  stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
+search: '`cloudtrail` eventName = JobCreated |  stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip  aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. 
@@ -20,14 +20,10 @@ tags:
   asset_type: AWS Account
   confidence: 80
   impact: 80
-  message: AWS Batch Job is created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
+  message: AWS Batch Job is created on account id - $aws_account_id$ from src_ip $src_ip$
   mitre_attack_id:
   - T1119
   observable:
-  - name: user_arn
-    type: User
-    role:
-    - Attacker
   - name: src_ip
     type: IP Address
     role:

detections/cloud/aws_exfiltration_via_ec2_snapshot.yml

@@ -23,11 +23,11 @@ tags:
   asset_type: EC2 Snapshot
   confidence: 80
   impact: 80
-  message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
+  message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $userName$ from src_ip $src_ip$
   mitre_attack_id:
   - T1537
   observable:
-  - name: user_arn
+  - name: userName
     type: User
     role:
     - Attacker

detections/cloud/aws_high_number_of_failed_authentications_for_user.yml

@@ -32,11 +32,7 @@ tags:
   mitre_attack_id:
   - T1201
   observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user_arn
+  - name: user_name
     type: User
     role:
     - Attacker

detections/cloud/aws_iam_delete_policy.yml

@@ -13,8 +13,8 @@ description: The following detection identifes when a policy is deleted on AWS.
 data_source: []
 search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
   count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
-  as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
-  userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
+  as policyArn by src user_arn eventName eventSource aws_account_id errorCode errorMessage
+  userAgent eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
   this data. The search requires AWS Cloudtrail logs.

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -12,7 +12,7 @@ description: Enforcing network-access controls is one of the defensive mechanism
   will query the AWS CloudTrail logs to detect users deleting network ACLs.
 data_source: []
 search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
-  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
+  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by user_arn
   userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)

detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml

@@ -52,10 +52,6 @@ tags:
     type: User
     role:
     - Victim
-  - name: ipAddress
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/azure_ad_user_enabled_and_password_reset.yml

@@ -37,11 +37,11 @@ tags:
   - T1098
   observable:
   - name: userPrincipalName
-    type: Other
+    type: User Name
     role:
     - Victim
   - name: initiatedBy
-    type: User
+    type: User Name
     role:
     - Attacker
   product:

detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml

@@ -31,7 +31,7 @@ tags:
   asset_type: AWS Instance
   confidence: 60
   impact: 70
-  message: User $user$ is modifying an instance $dest$ for the first time.
+  message: User $user$ is modifying an instance $object_id$ for the first time.
   mitre_attack_id:
   - T1078.004
   - T1078
@@ -40,10 +40,6 @@ tags:
     type: User
     role:
     - Attacker
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml

@@ -59,7 +59,7 @@ tags:
     type: IP Address
     role:
     - Attacker
-  - name: dest
+  - name: object
     type: Endpoint
     role:
     - Victim

detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml

@@ -46,10 +46,10 @@ tags:
   mitre_attack_id:
   - T1530
   observable:
-  - name: dest
-    type: Other
+  - name: remote_ip
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/detect_s3_access_from_a_new_ip.yml

@@ -35,10 +35,10 @@ tags:
   mitre_attack_id:
   - T1530
   observable:
-  - name: dest
-    type: Other
+  - name: src_ip
+    type: IP Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml

@@ -17,9 +17,7 @@ description: The following analytic identifies multiple failed multi-factor auth
   and APT29 have leveraged this technique to bypass multi-factor authentication controls
   as reported by Mandiant and others.
 data_source: []
-search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket
-  span=5m _time | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method,  _time
-  | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`'
+search: "`gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket span=5m _time | stats dc(_raw) AS mfa_prompts values(user) AS user by src_ip, login_challenge_method,  _time | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`"
 how_to_implement: You must install the latest version of Splunk Add-on for Google
   Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows
   Splunk administrators to collect Google Workspace event data in Splunk using Google

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -38,14 +38,10 @@ tags:
   - T1048.003
   - T1048
   observable:
-  - name: source.address
-    type: User
+  - name: dest_domain
+    type: IP Address
     role:
     - Attacker
-  - name: destination{}.address
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gsuite_suspicious_calendar_invite.yml

@@ -32,14 +32,14 @@ tags:
   asset_type: GSuite
   confidence: 50
   impact: 50
-  message: tbd
+  message: Gsuite suspicious calendar invite sent by $email$
   mitre_attack_id:
   - T1566
   observable:
-  - name: dest
-    type: Other
+  - name: email
+    type: Email Address
     role:
-    - Other
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -36,11 +36,7 @@ tags:
   - T1136.003
   - T1136
   observable:
-  - name: ActorIpAddress
-    type: IP Address
-    role:
-    - Attacker
-  - name: Actor.ID
+  - name: UserId
     type: User
     role:
     - Attacker

detections/cloud/o365_disable_mfa.yml

@@ -30,14 +30,10 @@ tags:
   mitre_attack_id:
   - T1556
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   - name: user
     type: User
     role:
-    - Attacker
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/active_setup_registry_autostart.yml

@@ -14,7 +14,7 @@ description: This analytic is to detect a suspicious modification of the active
   valid setup installer that creating or modifying this registry.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user 
   | `drop_dm_object_name(Registry)`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'