Branch was auto-updated.

.gitignore

@@ -122,3 +122,8 @@ bin/docker_detection_tester/apps/
 bin/docker_detection_tester/security_content/
 bin/docker_detection_tester/test_config.json
 bin/docker_detection_tester/test_results/
+
+#generated files
+lookups/APP_ENRICHMENT_CACHE.db.db
+lookups/CVE_CACHE.db.db
+lookups/REFERENCE_CACHE.db.db	

bin/docker_detection_tester/modules/validate_args.py

@@ -164,15 +164,21 @@ setup_schema = {
                     "app_number": 3110,
                     "app_version": "4.5.0",
                     "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
+                  },
+                  "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
+                    "app_number": 3088,
+                    "app_version": "4.0.0",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz"
+                  },
+                  "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
+                    "app_number": 3110,
+                    "app_version": "2.3.0",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
                 }
                   
             }
         },
 
-
-
-
-
         "mode": {
             "type": "string",
             "enum": ["changes", "selected", "all"],

bin/docker_detection_tester/test_config_github_actions.json

@@ -85,7 +85,17 @@
         "app_version": "1.9.2",
         "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
       },
-      "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
+      "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
+        "app_number": 3088,
+        "app_version": "4.0.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz"
+      },
+      "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
+        "app_number": 3110,
+        "app_version": "2.3.0",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
+    },
+    "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
         "app_number": 3110,
         "app_version": "4.5.0",
         "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"

detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml

@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
-search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
 known_false_positives: No known false postives for this detection. Please review this alert
 references:

detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml

@@ -8,8 +8,8 @@ datamodel: []
 description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. 
   The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. 
   While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`.
-search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip
-| eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip 
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip
+| eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by _time 
 | eval  upperBound=(ip_avg+ip_std*3) 
 | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment

detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml

@@ -3,7 +3,7 @@ id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea
 version: 1
 date: '2022-08-25'
 author: Mauricio Velazco, Splunk
-type: Anomaly
+type: TTP
 datamodel: []
 description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor.
   Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds.
@@ -40,7 +40,7 @@ tags:
   - Stage:Initial Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit.log
-  impact: 70
+  impact: 60
   kill_chain_phases:
   - Exploitation
   message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$
@@ -70,5 +70,5 @@ tags:
   - body.properties.authenticationDetails
   - body.properties.userPrincipalName
   - body.properties.ipAddress
-  risk_score: 63
+  risk_score: 54
   security_domain: identity

detections/cloud/azure_ad_successful_single_factor_authentication.yml

@@ -26,7 +26,7 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: 100
+  confidence: 90
   context:
   - Source:Cloud Data
   - Stage:Initial Access
@@ -37,7 +37,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $body.properties.userPrincipalName$ without MFA
   mitre_attack_id:
-  - T1003.002
+  - T1078
+  - T1078.004
   nist:
   - DE.CM
   observable:
@@ -61,5 +62,5 @@ tags:
   - body.properties.userPrincipalName
   - body.properties.ipAddress
   - body.properties.appDisplayName
-  risk_score: 50
+  risk_score: 45
   security_domain: identity

detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml

@@ -0,0 +1,63 @@
+name: GCP Authentication Failed During MFA Challenge
+id: 345f7e1d-a3fe-4158-abd8-e630f9878323
+version: 1
+date: '2022-10-12'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies an authentication attempt event against a Google Cloud Platform tenant that fails during the Multi Factor Authentication challenge.
+  This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. '
+search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods`
+  | stats values(user) by _time, src_ip, login_challenge_method
+  | `gcp_authentication_failed_during_mfa_challenge_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. 
+  Specifically, this analytic leverages the User log events.
+known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+references:
+- https://attack.mitre.org/techniques/T1621/ 
+- https://attack.mitre.org/techniques/T1078/004/
+tags:
+  analytic_story:
+  - GCP Account Takeover
+  asset_type: Google Cloud Platform tenant
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: User $user$ failed to pass MFA challenge
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  - T1621
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - src_ip
+  - login_challenge_method
+  - event.parameters{}.multiValue{}
+  risk_score: 54
+  security_domain: identity

detections/cloud/gcp_multi_factor_authentication_disabled.yml

@@ -0,0 +1,66 @@
+name: GCP Multi-Factor Authentication Disabled
+id: b9bc5513-6fc1-4821-85a3-e1d81e451c83
+version: 1
+date: '2022-10-12'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an attempt to disable multi-factor authentication for a GCP user. An adversary who has obtained access to an GCP tenant 
+  may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account.
+  This way the attackers can keep persistance in the environment without adding new users.
+search: ' `gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH 
+  | stats values(user) by _time, command, actor.email, status
+  | `gcp_multi_factor_authentication_disabled_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. 
+  Specifically, this analytic leverages the Admin log events.
+known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed.
+references:
+- https://support.google.com/cloudidentity/answer/2537800?hl=en
+- https://attack.mitre.org/tactics/TA0005/
+- https://attack.mitre.org/techniques/T1556/
+tags:
+  analytic_story:
+  - GCP Account Takeover
+  asset_type: GCP
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Persistence
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: MFA disabled for User $user$ initiated by $actor.email$  
+  mitre_attack_id:
+  - T1556
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: actor.email
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - actor.email
+  - user
+  - command
+  - status
+  risk_score: 45
+  security_domain: identity
+

detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml

@@ -0,0 +1,68 @@
+name: GCP Multiple Failed MFA Requests For User
+id: cbb3cb84-c06f-4393-adcc-5cb6195621f1
+version: 1
+date: '2022-10-14'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within a Google Cloud Platform tenant.
+  Specifically, the analytic triggers when 10 or more MFA user prompts fail within 5 minutes. Google CLoud tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds.
+  The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls
+  potentially resulting in the user finally accepting the authentication request.
+  Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.'
+search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods`
+  | bucket span=5m _time 
+  | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method,  _time
+  | where mfa_prompts >= 10
+  | `gcp_multiple_failed_mfa_requests_for_user_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `mfa_prompts` threshold values according to your environment.
+  Specifically, this analytic leverages the User log events.
+known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+references:
+- https://www.mandiant.com/resources/blog/russian-targeting-gov-business
+- https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/
+- https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/ 
+- https://attack.mitre.org/techniques/T1621/
+- https://attack.mitre.org/techniques/T1078/004/
+tags:
+  analytic_story:
+  - GCP Account Takeover
+  asset_type: Google Cloud Platform tenant
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Multiple Failed MFA requests for user $user$
+  mitre_attack_id:
+  - T1621
+  - T1078
+  - T1078.004 
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: 
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 54
+  security_domain: identity

detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml

@@ -0,0 +1,63 @@
+name: GCP Multiple Users Failing To Authenticate From Ip
+id: da20828e-d6fb-4ee5-afb7-d0ac200923d5
+version: 1
+date: '2022-10-12'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with more than 20 unique valid users within 5 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. 
+search: "`gws_reports_login` event.type = login event.name = login_failure | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts values(authentication_method) AS authentication_method earliest(_time) as firstTime latest(_time) as lastTime by _time event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`"
+how_to_implement:  You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment.
+  Specifically, this analytic leverages the User log events.
+known_false_positives: No known false postives for this detection. Please review this alert.
+references:
+- https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks
+- https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf
+tags:
+  analytic_story:
+  - GCP Account Takeover
+  asset_type: Google Cloud Platform tenant
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Multiple failed login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - event.name
+  - event.type
+  - authentication_method
+  - app
+  - id.applicationName
+  - src
+  risk_score: 54
+  security_domain: threat

detections/cloud/gcp_successful_single_factor_authentication.yml

@@ -0,0 +1,64 @@
+name: GCP Successful Single-Factor Authentication
+id: 40e17d88-87da-414e-b253-8dc1e4f9555b
+version: 1
+date: '2022-10-12'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a successful authentication event against Google Cloud Platform for an account without Multi-Factor Authentication 
+  enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated'
+search: ' `gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods`
+  | stats values(user) by _time, src_ip, login_challenge_method
+  | `gcp_successful_single_factor_authentication_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. 
+  Specifically, this analytic leverages the User log events.
+known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
+references:
+- https://attack.mitre.org/techniques/T1078/004/
+- https://support.google.com/a/answer/175197?hl=en
+- https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f
+tags:
+  analytic_story:
+  - GCP Account Takeover
+  asset_type: Google Cloud Platform tenant
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Successful authentication for user $user$ without MFA
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - event.name
+  - event.parameters{}.multiValue{}
+  - user
+  - src_ip
+  - login_challenge_method
+  risk_score: 45
+  security_domain: identity

detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml

@@ -0,0 +1,65 @@
+name: GCP Unusual Number of Failed Authentications From Ip
+id: bd8097ed-958a-4873-87d9-44f2b4d85705
+version: 1
+date: '2022-10-13'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises.  While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `GCP Multiple Users Failing To Authenticate From Ip`
+search: "`gws_reports_login` event.type = login event.name = login_failure| bucket span=5m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts values(authentication_method) AS authentication_method by _time, src
+| eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by _time 
+| eval  upperBound=(ip_avg+ip_std*3) 
+| eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`"
+how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment.
+  Specifically, this analytic leverages the User log events.
+known_false_positives: No known false positives for this detection. Please review this alert
+references:
+- https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks
+- https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf
+tags:
+  analytic_story:
+  - GCP Account Takeover
+  asset_type: Google Cloud Platform tenant
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - event.name
+  - src
+  - event.type
+  - user_name
+  risk_score: 54
+  security_domain: threat

macros/gws_login_mfa_methods.yml

@@ -0,0 +1,4 @@
+definition: event.parameters{}.multiValue{} IN ("backup_code", "google_authenticator", "google_prompt", "idv_any_phone", "idv_preregistered_phone", "internal_two_factor", "knowledge_employee_id", "knowledge_preregistered_email", "login_location", "knowledge_preregistered_phone", "offline_otp", "security_key", "security_key_otp")
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: gws_login_mfa_methods

macros/gws_reports_admin.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=gws:reports:admin
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: gws_reports_admin

macros/gws_reports_login.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=gws:reports:login
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: gws_reports_login

stories/gcp_account_takeover.yml

@@ -0,0 +1,29 @@
+name: GCP Account Takeover
+id: 8601caff-414f-4c6d-9a04-75b66778869d
+version: 1
+date: '2022-10-12'
+author: Mauricio Velazco, Bhavin Patel, Splunk
+description: Monitor for activities and techniques associated with Account Takover
+  attacks against Google Cloud Platform tenants.
+narrative: '
+
+  Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, 
+  phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, 
+  or use any stolen information to access further accounts within the organization.\
+  This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.'
+references: 
+- https://cloud.google.com/gcp
+- https://cloud.google.com/architecture/identity/overview-google-authentication
+- 
+- https://attack.mitre.org/techniques/T1586/
+- https://www.imperva.com/learn/application-security/account-takeover-ato/
+- https://www.barracuda.com/glossary/account-takeover
+tags:
+  analytic_story: GCP Account Takeover
+  category:
+  - Account Compromise
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/cloud/gcp_authentication_failed_during_mfa_challenge.test.yml

@@ -0,0 +1,13 @@
+name: GCP Authentication Failed During MFA Challenge Unit Test
+tests:
+- name: GCP Authentication Failed During MFA Challenge
+  file: cloud/gcp_authentication_failed_during_mfa_challenge.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: gws_login.yml
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login.log
+    source: gws:reports:login
+    sourcetype: gws:reports:login
+    update_timestamp: true

tests/cloud/gcp_multi_factor_authentication_disabled.test.yml

@@ -0,0 +1,13 @@
+name: GCP Multi-Factor Authentication Disabled Unit Test
+tests:
+- name: GCP Multi-Factor Authentication Disabled
+  file: cloud/gcp_multi_factor_authentication_disabled.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: gws_admin.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin.log
+    source: gws:reports:admin
+    sourcetype: gws:reports:admin
+    update_timestamp: true

tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml

@@ -0,0 +1,13 @@
+name: GCP Multiple Failed MFA Requests For User Unit Test
+tests:
+- name: GCP Multiple Failed MFA Requests For User
+  file: cloud/gcp_multiple_failed_mfa_requests_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: gws_login.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login.log
+    source: gws:reports:login
+    sourcetype: gws:reports:login
+    update_timestamp: true

tests/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: GCP Multiple Users Failing To Authenticate From Ip Unit Test
+tests:
+- name: GCP Multiple Users Failing To Authenticate From Ip
+  file: cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: gws_login.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json
+    source: gws_login
+    sourcetype: gws:reports:login
+    update_timestamp: true

tests/cloud/gcp_successful_single_factor_authentication.test.yml

@@ -0,0 +1,13 @@
+name: GCP Successful Single-Factor Authentication Unit Test
+tests:
+- name: GCP Successful Single-Factor Authentication
+  file: cloud/gcp_successful_single_factor_authentication.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: gws_login.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login.log
+    source: gws:reports:login
+    sourcetype: gws:reports:login
+    update_timestamp: true

tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: GCP Unusual Number of Failed Authentications From Ip Unit Test
+tests:
+- name: GCP Unusual Number of Failed Authentications From Ip
+  file: cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: gws_login.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json
+    source: gws_login
+    sourcetype: gws:reports:login
+    update_timestamp: true