From 071415c0af709aed7e255cad32f5a4421728577d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 28 Jul 2023 11:46:28 -0500 Subject: [PATCH 1/2] observable fix for cloud --- detections/application/okta_mfa_exhaustion_hunt.yml | 6 +++--- .../application/okta_two_or_more_rejected_okta_pushes.yml | 6 +++--- ...tent_xss_in_rapiddiag_through_user_interface_views.yml | 2 +- ..._protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...otocol_impersonation_weak_encryption_simplerequest.yml | 2 +- detections/cloud/aws_exfiltration_via_batch_service.yml | 4 ++-- detections/cloud/aws_exfiltration_via_ec2_snapshot.yml | 4 ++-- ...aws_high_number_of_failed_authentications_for_user.yml | 6 +----- detections/cloud/aws_iam_delete_policy.yml | 4 ++-- .../cloud/aws_network_access_control_list_deleted.yml | 2 +- .../cloud/aws_new_mfa_method_registered_for_user.yml | 2 +- .../azure_ad_multiple_failed_mfa_requests_for_user.yml | 4 ---- .../cloud/azure_ad_user_enabled_and_password_reset.yml | 4 ++-- .../cloud_instance_modified_by_previously_unseen_user.yml | 6 +----- ..._provisioning_activity_from_previously_unseen_city.yml | 2 +- .../cloud/detect_gcp_storage_access_from_a_new_ip.yml | 6 +++--- detections/cloud/detect_s3_access_from_a_new_ip.yml | 6 +++--- .../cloud/gcp_multiple_failed_mfa_requests_for_user.yml | 6 ++---- ..._outbound_email_with_attachment_to_external_domain.yml | 8 ++------ detections/cloud/gsuite_suspicious_calendar_invite.yml | 8 ++++---- .../cloud/o365_add_app_role_assignment_grant_user.yml | 6 +----- detections/cloud/o365_disable_mfa.yml | 6 +----- .../endpoint/7zip_commandline_to_smb_share_path.yml | 2 +- detections/endpoint/active_setup_registry_autostart.yml | 2 +- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 25 files changed, 41 insertions(+), 67 deletions(-) diff --git a/detections/application/okta_mfa_exhaustion_hunt.yml b/detections/application/okta_mfa_exhaustion_hunt.yml index 5e3018879f..36de8ced91 100644 --- a/detections/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/application/okta_mfa_exhaustion_hunt.yml @@ -39,11 +39,11 @@ tags: asset_type: Infrastructure confidence: 60 impact: 30 - message: $src_user$ account has rejected multiple Okta pushes. + message: $user$ account has rejected multiple Okta pushes. mitre_attack_id: - T1110 observable: - - name: src_user + - name: user type: User role: - Attacker @@ -53,7 +53,7 @@ tags: - Splunk Cloud required_fields: - _time - - src_user + - user - src_ip - eventType - status diff --git a/detections/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/application/okta_two_or_more_rejected_okta_pushes.yml index dd7ea4203d..311a5559d6 100644 --- a/detections/application/okta_two_or_more_rejected_okta_pushes.yml +++ b/detections/application/okta_two_or_more_rejected_okta_pushes.yml @@ -33,11 +33,11 @@ tags: asset_type: Infrastructure confidence: 80 impact: 80 - message: $src_user$ account has rejected multiple Okta pushes. + message: $user$ account has rejected multiple Okta pushes. mitre_attack_id: - T1110 observable: - - name: src_user + - name: user type: User role: - Attacker @@ -47,7 +47,7 @@ tags: - Splunk Cloud required_fields: - _time - - src_user + - user - src_ip - eventType - status diff --git a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml index 753ec43344..f2ca135af8 100644 --- a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml +++ b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml @@ -30,7 +30,7 @@ tags: mitre_attack_id: - T1189 observable: - - name: User + - name: user type: User role: - Victim diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 702e625828..f4eb08f9fc 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -36,7 +36,7 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: Hostname + - name: host type: Hostname role: - Victim diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 338370a82d..cc2dfb78d6 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -38,7 +38,7 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: Hostname + - name: host type: Hostname role: - Victim diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml index a82ad0634f..799b8a5e66 100644 --- a/detections/cloud/aws_exfiltration_via_batch_service.yml +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -2,12 +2,12 @@ name: AWS Exfiltration via Batch Service id: 04455dd3-ced7-480f-b8e6-5469b99e98e2 version: 1 date: '2023-04-24' -author: '' +author: Bhavin Patel, Splunk status: production type: TTP data_source: [] description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. -search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' +search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip user_arn aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml index ce77625e43..7bd0663985 100644 --- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -23,11 +23,11 @@ tags: asset_type: EC2 Snapshot confidence: 80 impact: 80 - message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $userName$ from src_ip $src_ip$ mitre_attack_id: - T1537 observable: - - name: user_arn + - name: userName type: User role: - Attacker diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml index 5f4e109b21..9289505ac8 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -32,11 +32,7 @@ tags: mitre_attack_id: - T1201 observable: - - name: src_ip - type: IP Address - role: - - Attacker - - name: user_arn + - name: user_name type: User role: - Attacker diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 51e096eeaf..c237979df7 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -13,8 +13,8 @@ description: The following detection identifes when a policy is deleted on AWS. data_source: [] search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) - as policyArn by src eventName eventSource aws_account_id errorCode errorMessage - userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)` + as policyArn by src user_arn eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 298acf55f5..e2548632ec 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -12,7 +12,7 @@ description: Enforcing network-access controls is one of the defensive mechanism will query the AWS CloudTrail logs to detect users deleting network ACLs. data_source: [] search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false - | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 7884cc68c0..1e6b64e9dc 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -35,7 +35,7 @@ tags: - T1556 - T1556.006 observable: - - name: user_name + - name: user_arn type: User role: - Victim diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index 02cf5f305b..50623f2281 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -52,10 +52,6 @@ tags: type: User role: - Victim - - name: ipAddress - type: IP Address - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index ee5ece7b03..0a63d39a73 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -36,8 +36,8 @@ tags: mitre_attack_id: - T1098 observable: - - name: displayName - type: Other + - name: userPrincipalName + type: User role: - Victim - name: initiatedBy diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index af9b5feb36..292aa73f4f 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -31,7 +31,7 @@ tags: asset_type: AWS Instance confidence: 60 impact: 70 - message: User $user$ is modifying an instance $dest$ for the first time. + message: User $user$ is modifying an instance $object_id$ for the first time. mitre_attack_id: - T1078.004 - T1078 @@ -40,10 +40,6 @@ tags: type: User role: - Attacker - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 7507a5ad98..ecfe277fb4 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -59,7 +59,7 @@ tags: type: IP Address role: - Attacker - - name: dest + - name: object type: Endpoint role: - Victim diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml index 0e4ab2a745..787757534a 100644 --- a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -46,10 +46,10 @@ tags: mitre_attack_id: - T1530 observable: - - name: dest - type: Other + - name: remote_ip + type: IP Address role: - - Other + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml index 4a974e398a..7d0e3ea164 100644 --- a/detections/cloud/detect_s3_access_from_a_new_ip.yml +++ b/detections/cloud/detect_s3_access_from_a_new_ip.yml @@ -35,10 +35,10 @@ tags: mitre_attack_id: - T1530 observable: - - name: dest - type: Other + - name: src_ip + type: IP Address role: - - Other + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml index 3368c5eaa5..06d8118388 100644 --- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -17,9 +17,7 @@ description: The following analytic identifies multiple failed multi-factor auth and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others. data_source: [] -search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket - span=5m _time | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method, _time - | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`' +search: "`gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket span=5m _time | stats dc(_raw) AS mfa_prompts values(user) AS user by src_ip, login_challenge_method, _time | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`" how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google @@ -52,7 +50,7 @@ tags: type: User role: - Victim - - name: null + - name: src_ip type: IP Address role: - Attacker diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index 72f798fbd7..98a3256e64 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -38,14 +38,10 @@ tags: - T1048.003 - T1048 observable: - - name: source.address - type: User + - name: dest_domain + type: IP Address role: - Attacker - - name: destination{}.address - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_suspicious_calendar_invite.yml b/detections/cloud/gsuite_suspicious_calendar_invite.yml index 9c793bc074..c6361c72bf 100644 --- a/detections/cloud/gsuite_suspicious_calendar_invite.yml +++ b/detections/cloud/gsuite_suspicious_calendar_invite.yml @@ -32,14 +32,14 @@ tags: asset_type: GSuite confidence: 50 impact: 50 - message: tbd + message: Gsuite suspicious calendar invite sent by $email$ mitre_attack_id: - T1566 observable: - - name: dest - type: Other + - name: email + type: Email Address role: - - Other + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 4c3c618e6c..a2024a7d5e 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -36,11 +36,7 @@ tags: - T1136.003 - T1136 observable: - - name: ActorIpAddress - type: IP Address - role: - - Attacker - - name: Actor.ID + - name: UserId type: User role: - Attacker diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 1f5573b54e..c01ae46697 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -30,14 +30,10 @@ tags: mitre_attack_id: - T1556 observable: - - name: dest - type: Endpoint - role: - - Victim - name: user type: User role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 9d5ee37152..f2c0bcb285 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -44,7 +44,7 @@ tags: type: Hostname role: - Victim - - name: SourceImage + - name: process_name type: Process role: - Attacker diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 35f2c90f73..328043d8a7 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -14,7 +14,7 @@ description: This analytic is to detect a suspicious modification of the active valid setup installer that creating or modifying this registry. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index d6f5b44704..d81b429c74 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -13,7 +13,7 @@ description: this search is to detect a suspicious registry modification to impl premise. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From e233b21c65062eb6daa0b87aaa0475c1b3b826ba Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 28 Jul 2023 13:11:50 -0500 Subject: [PATCH 2/2] spl fix --- detections/cloud/aws_exfiltration_via_batch_service.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml index 799b8a5e66..9a164540ff 100644 --- a/detections/cloud/aws_exfiltration_via_batch_service.yml +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: [] description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. -search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip user_arn aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' +search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. @@ -20,14 +20,10 @@ tags: asset_type: AWS Account confidence: 80 impact: 80 - message: AWS Batch Job is created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + message: AWS Batch Job is created on account id - $aws_account_id$ from src_ip $src_ip$ mitre_attack_id: - T1119 observable: - - name: user_arn - type: User - role: - - Attacker - name: src_ip type: IP Address role: