From cd70fb50e73c7ff1288554f8c8a6572cac91b654 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 12 Oct 2022 18:09:41 -0700 Subject: [PATCH 01/20] adding gcp configs --- .../modules/validate_args.py | 14 ++-- .../test_config_github_actions.json | 13 +++- ...mber_of_failed_authentications_from_ip.yml | 2 +- ..._users_failing_to_authenticate_from_ip.yml | 64 +++++++++++++++++++ macros/gws_reports_login.yml | 4 ++ ...s_failing_to_authenticate_from_ip.test.yml | 13 ++++ 6 files changed, 102 insertions(+), 8 deletions(-) create mode 100644 detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml create mode 100644 macros/gws_reports_login.yml create mode 100644 tests/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.test.yml diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index dcafc45337..b9029fce0e 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -164,15 +164,21 @@ setup_schema = { "app_number": 3110, "app_version": "4.5.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + }, + "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { + "app_number": 3088, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": { + "app_number": 3110, + "app_version": "2.3.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_230.tgz" } } }, - - - - "mode": { "type": "string", "enum": ["changes", "selected", "all"], diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 0872c356ea..e9d1d30720 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -85,11 +85,18 @@ "app_version": "1.9.2", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" }, - "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { + "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { + "app_number": 3088, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "2.3.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_230.tgz" } + } + }, "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", "commit_hash": null, diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index a43bc7e2b3..38bf444caa 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -9,7 +9,7 @@ description: The following analytic identifies one source IP failing to authenti The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`. search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip -| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip +| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by _time | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml new file mode 100644 index 0000000000..427b146904 --- /dev/null +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -0,0 +1,64 @@ +name: GCP Multiple Users Failing To Authenticate From Ip +id: da20828e-d6fb-4ee5-afb7-d0ac200923d5 +version: 1 +date: '2022-10-12' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with 20 unique valid users within 10 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. +search: "`gws_reports_login` authentication_method IN ( "google_password", "password, password", "password" ) event.type = "login" event.name = "login_failure" | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts earliest(_time) as firstTime latest(_time) as lastTime by _time authentication_method event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" + +how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. s +known_false_positives: No known false postives for this detection. Please review this alert! +references: +- https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ +tags: + analytic_story: + - ----- + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json + impact: 60 + kill_chain_phases: + - Exploitation + message: Multiple failed login attempts against users $tried_accounts$ seen from $src_ip$ + mitre_attack_id: + - T1110.003 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: tried_accounts + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - user + - action + - eventName + - src_ip + risk_score: 54 + security_domain: threat diff --git a/macros/gws_reports_login.yml b/macros/gws_reports_login.yml new file mode 100644 index 0000000000..5e759542e7 --- /dev/null +++ b/macros/gws_reports_login.yml @@ -0,0 +1,4 @@ +definition: sourcetype=gws:reports:login +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gws_reports_login diff --git a/tests/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.test.yml b/tests/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.test.yml new file mode 100644 index 0000000000..15198badc8 --- /dev/null +++ b/tests/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.test.yml @@ -0,0 +1,13 @@ +name: GCP Multiple Users Failing To Authenticate From Ip Unit Test +tests: +- name: GCP Multiple Users Failing To Authenticate From Ip + file: cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: gws_login.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json + source: gws_login + sourcetype: gws:reports:login + update_timestamp: true From 92f0ff7f5f7a726cc809a9d5bd04ca0ae17ffc82 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Oct 2022 15:58:37 -0700 Subject: [PATCH 02/20] gcp_stdev --- ..._users_failing_to_authenticate_from_ip.yml | 4 +- ...mber_of_failed_authentications_from_ip.yml | 64 +++++++++++++++++++ ...of_failed_authentications_from_ip.test.yml | 13 ++++ 3 files changed, 78 insertions(+), 3 deletions(-) create mode 100644 detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml create mode 100644 tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 427b146904..9b3a78d160 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -4,11 +4,9 @@ version: 1 date: '2022-10-12' author: Bhavin Patel, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with 20 unique valid users within 10 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. search: "`gws_reports_login` authentication_method IN ( "google_password", "password, password", "password" ) event.type = "login" event.name = "login_failure" | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts earliest(_time) as firstTime latest(_time) as lastTime by _time authentication_method event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" - how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. s known_false_positives: No known false postives for this detection. Please review this alert! references: diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..67d8af1864 --- /dev/null +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,64 @@ +name: GCP Unusual Number of Failed Authentications From Ip +id: bd8097ed-958a-4873-87d9-44f2b4d85705 +version: 1 +date: '2022-10-13' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: [] +description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. + The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. + While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip` +search: '`gws_reports_login` authentication_method IN ( google_password, password, password, password ) event.type = login event.name = login_failure| bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip +| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip +| eval upperBound=(ip_avg+ip_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment +known_false_positives: No known false postives for this detection. Please review this alert +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +tags: + analytic_story: + - ----- + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json + impact: 60 + kill_chain_phases: + - Exploitation + message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$ + mitre_attack_id: + - T1110.003 + nist: + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: tried_accounts + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - authentication_method + - event.type + - event.name + - user_name + risk_score: 54 + security_domain: threat diff --git a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..e1c7e62df5 --- /dev/null +++ b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: GCP Unusual Number of Failed Authentications From Ip Unit Test +tests: +- name: GCP Unusual Number of Failed Authentications From Ip + file: cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From 7ec46bd832bc7611663634fd7bebe87df648266d Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Oct 2022 16:33:32 -0700 Subject: [PATCH 03/20] spl updates --- ...multiple_users_failing_to_authenticate_from_ip.yml | 4 ++-- ...usual_number_of_failed_authentications_from_ip.yml | 11 +++++------ 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 9b3a78d160..68685258e2 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -6,8 +6,8 @@ author: Bhavin Patel, Splunk type: Anomaly datamodel: [] description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with 20 unique valid users within 10 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. -search: "`gws_reports_login` authentication_method IN ( "google_password", "password, password", "password" ) event.type = "login" event.name = "login_failure" | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts earliest(_time) as firstTime latest(_time) as lastTime by _time authentication_method event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" -how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. s +search: "`gws_reports_login` authentication_method IN (google_password, password, password, password ) event.type = login event.name = login_failure | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts earliest(_time) as firstTime latest(_time) as lastTime by _time authentication_method event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" +how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. known_false_positives: No known false postives for this detection. Please review this alert! references: - https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index 67d8af1864..935d9c2118 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -5,15 +5,14 @@ date: '2022-10-13' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. - The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. - While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip` -search: '`gws_reports_login` authentication_method IN ( google_password, password, password, password ) event.type = login event.name = login_failure| bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip +description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip` +search: "`gws_reports_login` authentication_method IN ( google_password, password, password, password ) event.type = login event.name = login_failure| bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip | eval upperBound=(ip_avg+ip_std*3) -| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`' +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`" + how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment -known_false_positives: No known false postives for this detection. Please review this alert +known_false_positives: No known false positives for this detection. Please review this alert references: - https://attack.mitre.org/techniques/T1110/003/ - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ From ab378d6705ea100edbd8c4da401178950c349e03 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Oct 2022 16:47:29 -0700 Subject: [PATCH 04/20] addo_test --- bin/docker_detection_tester/test_config_github_actions.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index e9d1d30720..6342bbbd40 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -95,7 +95,7 @@ "app_version": "2.3.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_230.tgz" } - } + }, "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", From 62b75ad9a4d03f7570f2bfca3322efa75cbb4ca5 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Oct 2022 16:52:13 -0700 Subject: [PATCH 05/20] ignore lookups.db.db files --- .gitignore | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index dbcd196ffc..ed6fee4e92 100644 --- a/.gitignore +++ b/.gitignore @@ -120,5 +120,10 @@ notes bin/docker_detection_tester/*-test-run.json bin/docker_detection_tester/apps/ bin/docker_detection_tester/security_content/ -bin/docker_detection_tester/test_config.json +bin/docker_detection_tester/test_config. bin/docker_detection_tester/test_results/ + +#generated files +lookups/APP_ENRICHMENT_CACHE.db.db +lookups/CVE_CACHE.db.db +lookups/REFERENCE_CACHE.db.db From 56abcaeb129c968f09fb77b095947e829d5ba513 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Oct 2022 18:07:01 -0700 Subject: [PATCH 06/20] new sourcetype --- ...l_number_of_failed_authentications_from_ip.test.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml index e1c7e62df5..4e1569beb3 100644 --- a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml +++ b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE - update_timestamp: true + - file_name: gws_login.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json + source: gws_login + sourcetype: gws:reports:login + update_timestamp: true From 744bc501902243d60ba08a1cbb624206f852c58e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 14 Oct 2022 15:03:54 -0400 Subject: [PATCH 07/20] adding 4 GCP account takeover detections --- ..._multiple_failed_mfa_requests_for_user.yml | 4 +- ...uccessful_single_factor_authentication.yml | 7 +- ...entication_failed_during_mfa_challenge.yml | 63 ++++++++++++++++++ ...p_multi_factor_authentication_disabled.yml | 66 +++++++++++++++++++ ..._multiple_failed_mfa_requests_for_user.yml | 65 ++++++++++++++++++ ...uccessful_single_factor_authentication.yml | 63 ++++++++++++++++++ macros/gws_login_mfa_methods.yml | 4 ++ macros/gws_reports_admin.yml | 4 ++ stories/gcp_account_takeover.yml | 29 ++++++++ ...ation_failed_during_mfa_challenge.test.yml | 13 ++++ ...ti_factor_authentication_disabled.test.yml | 13 ++++ ...iple_failed_mfa_requests_for_user.test.yml | 13 ++++ ...sful_single_factor_authentication.test.yml | 13 ++++ 13 files changed, 352 insertions(+), 5 deletions(-) create mode 100644 detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml create mode 100644 detections/cloud/gcp_multi_factor_authentication_disabled.yml create mode 100644 detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml create mode 100644 detections/cloud/gcp_successful_single_factor_authentication.yml create mode 100644 macros/gws_login_mfa_methods.yml create mode 100644 macros/gws_reports_admin.yml create mode 100644 stories/gcp_account_takeover.yml create mode 100644 tests/cloud/gcp_authentication_failed_during_mfa_challenge.test.yml create mode 100644 tests/cloud/gcp_multi_factor_authentication_disabled.test.yml create mode 100644 tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml create mode 100644 tests/cloud/gcp_successful_single_factor_authentication.test.yml diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index 7ae55b0dd0..de331e02e4 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -3,7 +3,7 @@ id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea version: 1 date: '2022-08-25' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. @@ -40,7 +40,7 @@ tags: - Stage:Initial Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit.log - impact: 70 + impact: 60 kill_chain_phases: - Exploitation message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$ diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 9f96956096..fccef2afd6 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -26,7 +26,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 100 + confidence: 90 context: - Source:Cloud Data - Stage:Initial Access @@ -37,7 +37,8 @@ tags: - Exploitation message: Successful authentication for user $body.properties.userPrincipalName$ without MFA mitre_attack_id: - - T1003.002 + - T1078 + - T1078.004 nist: - DE.CM observable: @@ -61,5 +62,5 @@ tags: - body.properties.userPrincipalName - body.properties.ipAddress - body.properties.appDisplayName - risk_score: 50 + risk_score: 45 security_domain: identity diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml new file mode 100644 index 0000000000..73c6558462 --- /dev/null +++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml @@ -0,0 +1,63 @@ +name: GCP Authentication Failed During MFA Challenge +id: 345f7e1d-a3fe-4158-abd8-e630f9878323 +version: 1 +date: '2022-10-12' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies an authentication attempt event against a Google Cloud Platform tenant that fails during the Multi Factor Authentication challenge. + This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. ' +search: ' event.name=login_failure `gws_login_mfa_methods` + | stats values(user) by _time, src_ip, login_challenge_method + | `gcp_authentication_failed_during_mfa_challenge_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. + Specifically, this analytic leverages the User log events. +known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. +references: +- https://attack.mitre.org/techniques/T1621/ +- https://attack.mitre.org/techniques/T1078/004/ +tags: + analytic_story: + - GCP Account Takeover + asset_type: Google Cloud Platform tenant + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login.log + impact: 60 + kill_chain_phases: + - Exploitation + message: User $user$ failed to pass MFA challenge + mitre_attack_id: + - T1078 + - T1078.004 + - T1621 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - user + - src_ip + - login_challenge_method + - event.parameters{}.multiValue{} + risk_score: 54 + security_domain: identity diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml new file mode 100644 index 0000000000..3d08899cad --- /dev/null +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -0,0 +1,66 @@ +name: GCP Multi-Factor Authentication Disabled +id: b9bc5513-6fc1-4821-85a3-e1d81e451c83 +version: 1 +date: '2022-10-12' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an attempt to disable multi-factor authentication for a GCP user. An adversary who has obtained access to an GCP tenant + may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. + This way the attackers can keep persistance in the environment without adding new users. +search: ' `gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH + | stats values(user) by _time, command, actor.email, status + | `gcp_multi_factor_authentication_disabled_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. + Specifically, this analytic leverages the Admin log events. +known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed. +references: +- https://support.google.com/cloudidentity/answer/2537800?hl=en +- https://attack.mitre.org/tactics/TA0005/ +- https://attack.mitre.org/techniques/T1556/ +tags: + analytic_story: + - GCP Account Takeover + asset_type: GCP + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin.log + impact: 50 + kill_chain_phases: + - Installation + - Actions on Objectives + message: MFA disabled for User $user$ initiated by $actor.email$ + mitre_attack_id: + - T1556 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: actor.email + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - actor.email + - user + - command + - status + risk_score: 45 + security_domain: identity + diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml new file mode 100644 index 0000000000..193ffef8d2 --- /dev/null +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -0,0 +1,65 @@ +name: GCP Multiple Failed MFA Requests For User +id: cbb3cb84-c06f-4393-adcc-5cb6195621f1 +version: 1 +date: '2022-10-14' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within a Google Cloud Platform tenant. + Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. + The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls + potentially resulting in the user finally accepting the authentication request. + Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.' +search: ' + | `gcp_multiple_failed_mfa_requests_for_user_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. + Specifically, this analytic leverages the User log events. +known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed. +references: +- https://www.mandiant.com/resources/blog/russian-targeting-gov-business +- https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/ +- https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/ +- https://attack.mitre.org/techniques/T1621/ +- https://attack.mitre.org/techniques/T1078/004/ +tags: + analytic_story: + - GCP Account Takeover + asset_type: Google Cloud Platform tenant + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - UPDATE_DATASET_URL + impact: 60 + kill_chain_phases: + - Exploitation + message: Multiple Failed MFA requests for user $user$ + mitre_attack_id: + - T1621 + - T1078 + - T1078.004 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: + type: IP Address + role: + - Attacker + product: + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + risk_score: 54 + security_domain: identity diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml new file mode 100644 index 0000000000..ca41c3b013 --- /dev/null +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -0,0 +1,63 @@ +name: GCP Successful Single-Factor Authentication +id: 40e17d88-87da-414e-b253-8dc1e4f9555b +version: 1 +date: '2022-10-12' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies a successful authentication event against Google Cloud Platform for an account without Multi-Factor Authentication + enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated' +search: ' `gws_reports_login`event.name=login_success NOT `gws_login_mfa_methods` + | stats values(user) by _time, src_ip, login_challenge_method + | `gcp_successful_single_factor_authentication_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. + Specifically, this analytic leverages the User log events. +known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed +references: +- https://attack.mitre.org/techniques/T1078/004/ +- https://support.google.com/a/answer/175197?hl=en +- https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f +tags: + analytic_story: + - GCP Account Takeover + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login.log + impact: 50 + kill_chain_phases: + - Exploitation + message: Successful authentication for user $user$ without MFA + - T1078 + - T1078.004 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - event.name + - event.parameters{}.multiValue{} + - user + - src_ip + - login_challenge_method + risk_score: 45 + security_domain: identity diff --git a/macros/gws_login_mfa_methods.yml b/macros/gws_login_mfa_methods.yml new file mode 100644 index 0000000000..a5069104aa --- /dev/null +++ b/macros/gws_login_mfa_methods.yml @@ -0,0 +1,4 @@ +definition: event.parameters{}.multiValue{} IN ("backup_code", "google_authenticator", "google_prompt", "idv_any_phone", "idv_preregistered_phone", "internal_two_factor", "knowledge_employee_id", "knowledge_preregistered_email", "login_location", "knowledge_preregistered_phone", "offline_otp", "security_key", "security_key_otp") +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gws_login_mfa_methods diff --git a/macros/gws_reports_admin.yml b/macros/gws_reports_admin.yml new file mode 100644 index 0000000000..2de3cbb395 --- /dev/null +++ b/macros/gws_reports_admin.yml @@ -0,0 +1,4 @@ +definition: sourcetype=gws:reports:admin +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gws_reports_admin diff --git a/stories/gcp_account_takeover.yml b/stories/gcp_account_takeover.yml new file mode 100644 index 0000000000..a1b9ac581b --- /dev/null +++ b/stories/gcp_account_takeover.yml @@ -0,0 +1,29 @@ +name: GCP Account Takeover +id: 8601caff-414f-4c6d-9a04-75b66778869d +version: 1 +date: '2022-10-12' +author: Mauricio Velazco, Bhavin Patel, Splunk +description: Monitor for activities and techniques associated with Account Takover + attacks against Google Cloud Platform tenants. +narrative: ' + + Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, + phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, + or use any stolen information to access further accounts within the organization.\ + This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.' +references: +- https://cloud.google.com/gcp +- https://cloud.google.com/architecture/identity/overview-google-authentication +- +- https://attack.mitre.org/techniques/T1586/ +- https://www.imperva.com/learn/application-security/account-takeover-ato/ +- https://www.barracuda.com/glossary/account-takeover +tags: + analytic_story: GCP Account Takeover + category: + - Account Compromise + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/cloud/gcp_authentication_failed_during_mfa_challenge.test.yml b/tests/cloud/gcp_authentication_failed_during_mfa_challenge.test.yml new file mode 100644 index 0000000000..8d7276a9e4 --- /dev/null +++ b/tests/cloud/gcp_authentication_failed_during_mfa_challenge.test.yml @@ -0,0 +1,13 @@ +name: GCP Authentication Failed During MFA Challenge Unit Test +tests: +- name: GCP Authentication Failed During MFA Challenge + file: cloud/gcp_authentication_failed_during_mfa_challenge.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: gws_login.yml + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login.log + source: gws:reports:login + sourcetype: gws:reports:login + update_timestamp: true diff --git a/tests/cloud/gcp_multi_factor_authentication_disabled.test.yml b/tests/cloud/gcp_multi_factor_authentication_disabled.test.yml new file mode 100644 index 0000000000..65533c1497 --- /dev/null +++ b/tests/cloud/gcp_multi_factor_authentication_disabled.test.yml @@ -0,0 +1,13 @@ +name: GCP Multi-Factor Authentication Disabled Unit Test +tests: +- name: GCP Multi-Factor Authentication Disabled + file: cloud/gcp_multi_factor_authentication_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: gws_admin.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin.log + source: gws:reports:admin + sourcetype: gws:reports:admin + update_timestamp: true diff --git a/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml b/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml new file mode 100644 index 0000000000..fe1fc50cb6 --- /dev/null +++ b/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml @@ -0,0 +1,13 @@ +name: GCP Multiple Failed MFA Requests For User Unit Test +tests: +- name: GCP Multiple Failed MFA Requests For User + file: cloud/gcp_multiple_failed_mfa_requests_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: gws_login.log + data: UPDATE + source: gws:reports:login + sourcetype: gws:reports:login + update_timestamp: true diff --git a/tests/cloud/gcp_successful_single_factor_authentication.test.yml b/tests/cloud/gcp_successful_single_factor_authentication.test.yml new file mode 100644 index 0000000000..c54bc87423 --- /dev/null +++ b/tests/cloud/gcp_successful_single_factor_authentication.test.yml @@ -0,0 +1,13 @@ +name: GCP Successful Single-Factor Authentication Unit Test +tests: +- name: GCP Successful Single-Factor Authentication + file: cloud/gcp_successful_single_factor_authentication.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: gws_login.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login.log + source: gws:reports:login + sourcetype: gws:reports:login + update_timestamp: true From ecda6231c99f818126b1ba960927418652737da7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 14 Oct 2022 15:06:12 -0400 Subject: [PATCH 08/20] gitignore fix --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index ed6fee4e92..8a3262dc05 100644 --- a/.gitignore +++ b/.gitignore @@ -120,7 +120,7 @@ notes bin/docker_detection_tester/*-test-run.json bin/docker_detection_tester/apps/ bin/docker_detection_tester/security_content/ -bin/docker_detection_tester/test_config. +bin/docker_detection_tester/test_config.json bin/docker_detection_tester/test_results/ #generated files From ec4829ad7fe8acb73e8c3af7353114faf1703b45 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 14 Oct 2022 12:20:23 -0700 Subject: [PATCH 09/20] Update gcp_multiple_users_failing_to_authenticate_from_ip.yml --- .../gcp_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 68685258e2..7f02a119d8 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -17,7 +17,7 @@ references: - https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ tags: analytic_story: - - ----- + - GCP Account Takeover asset_type: AWS Account cis20: - CIS 3 From 7ab9b56f723da238d79824c80cca58366b9f14d1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 14 Oct 2022 12:20:52 -0700 Subject: [PATCH 10/20] Update gcp_unusual_number_of_failed_authentications_from_ip.yml --- .../gcp_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index 935d9c2118..7402bb89fc 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -18,7 +18,7 @@ references: - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ tags: analytic_story: - - ----- + - GCP Account Takeover asset_type: AWS Account cis20: - CIS 3 From 5b4074dd23b0ac1ada6e959fa785a5962548a930 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 14 Oct 2022 15:36:28 -0700 Subject: [PATCH 11/20] hti update --- .../gcp_unusual_number_of_failed_authentications_from_ip.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index 7402bb89fc..c03b6e77c5 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -10,8 +10,7 @@ search: "`gws_reports_login` authentication_method IN ( google_password, passw | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`" - -how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment +how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. known_false_positives: No known false positives for this detection. Please review this alert references: - https://attack.mitre.org/techniques/T1110/003/ @@ -19,7 +18,7 @@ references: tags: analytic_story: - GCP Account Takeover - asset_type: AWS Account + asset_type: GCP tenant cis20: - CIS 3 - CIS 5 From 2afe6af188e3bcecb483fc417cf0023504b1e4a1 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 17 Oct 2022 11:44:39 -0400 Subject: [PATCH 12/20] fixing yaml issues --- .../azure_ad_multiple_failed_mfa_requests_for_user.yml | 2 +- .../cloud/gcp_successful_single_factor_authentication.yml | 1 + ...sual_number_of_failed_authentications_from_ip.test.yml | 8 ++++---- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index de331e02e4..1cdf572c42 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -70,5 +70,5 @@ tags: - body.properties.authenticationDetails - body.properties.userPrincipalName - body.properties.ipAddress - risk_score: 63 + risk_score: 54 security_domain: identity diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml index ca41c3b013..77136ae1e1 100644 --- a/detections/cloud/gcp_successful_single_factor_authentication.yml +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -35,6 +35,7 @@ tags: kill_chain_phases: - Exploitation message: Successful authentication for user $user$ without MFA + mitre_attack_id: - T1078 - T1078.004 nist: diff --git a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml index 4e1569beb3..d3c770e022 100644 --- a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml +++ b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: gws_login.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json - source: gws_login - sourcetype: gws:reports:login - update_timestamp: true + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json + source: gws_login + sourcetype: gws:reports:login + update_timestamp: true From bdaf3ebcf9b428f5b29571fc5c3db86a6b87de18 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 17 Oct 2022 12:11:19 -0400 Subject: [PATCH 13/20] updating amazon S3 url --- bin/docker_detection_tester/modules/validate_args.py | 4 ++-- bin/docker_detection_tester/test_config_github_actions.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index b9029fce0e..051c2cc3ea 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -168,12 +168,12 @@ setup_schema = { "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { "app_number": 3088, "app_version": "4.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_400.tgz" + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz" }, "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": { "app_number": 3110, "app_version": "2.3.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_230.tgz" + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz" } } diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 6342bbbd40..1ca12b9f37 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -88,12 +88,12 @@ "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { "app_number": 3088, "app_version": "4.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_400.tgz" + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz" }, "SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": { "app_number": 3110, "app_version": "2.3.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_230.tgz" + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz" } From e95c7f693767ef82b092468c810bf3a3c9e9433f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 17 Oct 2022 12:27:58 -0400 Subject: [PATCH 14/20] fixing detection --- .../cloud/gcp_successful_single_factor_authentication.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml index 77136ae1e1..4271525d28 100644 --- a/detections/cloud/gcp_successful_single_factor_authentication.yml +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: 'The following analytic identifies a successful authentication event against Google Cloud Platform for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated' -search: ' `gws_reports_login`event.name=login_success NOT `gws_login_mfa_methods` +search: ' `gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods` | stats values(user) by _time, src_ip, login_challenge_method | `gcp_successful_single_factor_authentication_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. From 142d52872fd62cf4ffa7f3bf48054e83b0068f7b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 18 Oct 2022 11:36:29 -0400 Subject: [PATCH 15/20] updating detection --- .../cloud/gcp_multiple_failed_mfa_requests_for_user.yml | 9 ++++++--- .../gcp_multiple_failed_mfa_requests_for_user.test.yml | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml index 193ffef8d2..15d125348e 100644 --- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -6,11 +6,14 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within a Google Cloud Platform tenant. - Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. + Specifically, the analytic triggers when 10 or more MFA user prompts fail within 5 minutes. Google CLoud tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.' -search: ' +search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` + | bucket span=5m _time + | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method, _time + | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. Specifically, this analytic leverages the User log events. @@ -34,7 +37,7 @@ tags: - Source:Cloud Data - Stage:Initial Access dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login.log impact: 60 kill_chain_phases: - Exploitation diff --git a/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml b/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml index fe1fc50cb6..f79fdbe99b 100644 --- a/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml +++ b/tests/cloud/gcp_multiple_failed_mfa_requests_for_user.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: gws_login.log - data: UPDATE + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login.log source: gws:reports:login sourcetype: gws:reports:login update_timestamp: true From 526ca4bd1b7db6634252e71b4c9acbed66e0bb5a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 18 Oct 2022 12:03:20 -0400 Subject: [PATCH 16/20] fixing detection --- .../cloud/gcp_authentication_failed_during_mfa_challenge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml index 73c6558462..088155e342 100644 --- a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: 'The following analytic identifies an authentication attempt event against a Google Cloud Platform tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. ' -search: ' event.name=login_failure `gws_login_mfa_methods` +search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | stats values(user) by _time, src_ip, login_challenge_method | `gcp_authentication_failed_during_mfa_challenge_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. From 1e963e553b272901a3c2fc9dc5d109b8ceec9aa7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 18 Oct 2022 18:07:50 -0700 Subject: [PATCH 17/20] yaml cleanup and references --- ..._users_failing_to_authenticate_from_ip.yml | 24 +++++++++---------- ...mber_of_failed_authentications_from_ip.yml | 18 +++++++------- 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 7f02a119d8..6b944113a1 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -5,20 +5,19 @@ date: '2022-10-12' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with 20 unique valid users within 10 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. -search: "`gws_reports_login` authentication_method IN (google_password, password, password, password ) event.type = login event.name = login_failure | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts earliest(_time) as firstTime latest(_time) as lastTime by _time authentication_method event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" +description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with more than 20 unique valid users within 5 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. +search: "`gws_reports_login` event.type = login event.name = login_failure | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts values(authentication_method) AS authentication_method earliest(_time) as firstTime latest(_time) as lastTime by _time event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. -known_false_positives: No known false postives for this detection. Please review this alert! +known_false_positives: No known false postives for this detection. Please review this alert. references: - https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks -references: +- https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite - https://attack.mitre.org/techniques/T1110/003/ -- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ -- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ +- https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf tags: analytic_story: - GCP Account Takeover - asset_type: AWS Account + asset_type: Google Cloud Platform tenant cis20: - CIS 3 - CIS 5 @@ -26,7 +25,6 @@ tags: confidence: 90 context: - Source:Cloud Data - - Outcome:Blocked - Stage:Recon - Other:Brute Force dataset: @@ -54,9 +52,11 @@ tags: - Splunk Cloud required_fields: - _time - - user - - action - - eventName - - src_ip + - event.name + - event.type + - authentication_method + - app + - id.applicationName + - src risk_score: 54 security_domain: threat diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index c03b6e77c5..1e9d063ddb 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -5,20 +5,22 @@ date: '2022-10-13' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip` -search: "`gws_reports_login` authentication_method IN ( google_password, password, password, password ) event.type = login event.name = login_failure| bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip -| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip +description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `GCP Multiple Users Failing To Authenticate From Ip` +search: "`gws_reports_login` event.type = login event.name = login_failure| bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts values(authentication_method) AS authentication_method by _time, src +| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`" how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. known_false_positives: No known false positives for this detection. Please review this alert references: +- https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks +- https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite - https://attack.mitre.org/techniques/T1110/003/ -- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +- https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf tags: analytic_story: - GCP Account Takeover - asset_type: GCP tenant + asset_type: Google Cloud Platform tenant cis20: - CIS 3 - CIS 5 @@ -40,7 +42,7 @@ tags: nist: - DE.CM observable: - - name: src_ip + - name: src type: IP Address role: - Attacker @@ -54,9 +56,9 @@ tags: - Splunk Cloud required_fields: - _time - - authentication_method - - event.type - event.name + - src + - event.type - user_name risk_score: 54 security_domain: threat From 0c6193617f5264f9a1aecad856d0d3d0cd2086ed Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 19 Oct 2022 14:45:10 -0700 Subject: [PATCH 18/20] _time in the by clause --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- .../aws_unusual_number_of_failed_authentications_from_ip.yml | 2 +- .../gcp_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 37311ef681..1ff5d539f2 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives: No known false postives for this detection. Please review this alert references: diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 38bf444caa..b035216410 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by _time | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index 1e9d063ddb..f43439d209 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: [] description: The following analytic identifies one source IP failing to authenticate into the Google Workspace with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against a Google Workspace enviroment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `GCP Multiple Users Failing To Authenticate From Ip` search: "`gws_reports_login` event.type = login event.name = login_failure| bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts values(authentication_method) AS authentication_method by _time, src -| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src +| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by _time | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`" how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. From 17ae3f4a2cf08101088b9ec9b71044fe8c611357 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 20 Oct 2022 17:35:27 -0400 Subject: [PATCH 19/20] updating how to implement --- .../cloud/gcp_authentication_failed_during_mfa_challenge.yml | 2 +- detections/cloud/gcp_multi_factor_authentication_disabled.yml | 2 +- detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml | 2 +- .../gcp_multiple_users_failing_to_authenticate_from_ip.yml | 3 ++- .../cloud/gcp_successful_single_factor_authentication.yml | 2 +- .../gcp_unusual_number_of_failed_authentications_from_ip.yml | 3 ++- 6 files changed, 8 insertions(+), 6 deletions(-) diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml index 088155e342..e6b4cea182 100644 --- a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml @@ -10,7 +10,7 @@ description: 'The following analytic identifies an authentication attempt event search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | stats values(user) by _time, src_ip, login_challenge_method | `gcp_authentication_failed_during_mfa_challenge_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events. known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. references: diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml index 3d08899cad..c135ab0a14 100644 --- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -11,7 +11,7 @@ description: The following analytic identifies an attempt to disable multi-facto search: ' `gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH | stats values(user) by _time, command, actor.email, status | `gcp_multi_factor_authentication_disabled_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the Admin log events. known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed. references: diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml index 15d125348e..f9f772128e 100644 --- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -15,7 +15,7 @@ search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method, _time | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `mfa_prompts` threshold values according to your environment. Specifically, this analytic leverages the User log events. known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed. references: diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 6b944113a1..6080732fcf 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -7,7 +7,8 @@ type: Anomaly datamodel: [] description: The following analytic identifies one source Ip failing to authenticate into the Google Workspace user accounts with more than 20 unique valid users within 5 minutes. These user accounts may have other privileges with respect to access to other sensitive resources in the Google Cloud Platform. This behavior could represent an adversary performing a Password Spraying attack against an Google Workspace environment to obtain initial access or elevate privileges. search: "`gws_reports_login` event.type = login event.name = login_failure | bucket span=5m _time | stats count dc(user) AS unique_accounts values(user) as tried_accounts values(authentication_method) AS authentication_method earliest(_time) as firstTime latest(_time) as lastTime by _time event.name src app id.applicationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where unique_accounts > 20 | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`" -how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. + Specifically, this analytic leverages the User log events. known_false_positives: No known false postives for this detection. Please review this alert. references: - https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml index 4271525d28..40541ed5f9 100644 --- a/detections/cloud/gcp_successful_single_factor_authentication.yml +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -10,7 +10,7 @@ description: 'The following analytic identifies a successful authentication even search: ' `gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods` | stats values(user) by _time, src_ip, login_challenge_method | `gcp_successful_single_factor_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556). You must be ingesting Google Workspace events into your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events. known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed references: diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index f43439d209..3673b54a81 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -10,7 +10,8 @@ search: "`gws_reports_login` event.type = login event.name = login_failure| buck | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by _time | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier =1| `gcp_unusual_number_of_failed_authentications_from_ip_filter`" -how_to_implement: Please install the Splunk Add-on for Google Workspace from Splunkbase(https://splunkbase.splunk.com/app/5556), which allows a Splunk administrator to collect Google Workspace event data using Google Workspace APIs in Splunk. These detections are based on user log events like authentication, password change, 2FA enrollment from the Google audit reports which are ingested into Splunk in `sourcetype=gws:reports:login`. Find more details about this dataset- https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. +how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. + Specifically, this analytic leverages the User log events. known_false_positives: No known false positives for this detection. Please review this alert references: - https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks From 1c10255e9d521b53fb6dc83eee78b5b9f47de71b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 31 Oct 2022 12:20:06 -0700 Subject: [PATCH 20/20] asset type --- .../cloud/gcp_successful_single_factor_authentication.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml index 40541ed5f9..ace2876b3a 100644 --- a/detections/cloud/gcp_successful_single_factor_authentication.yml +++ b/detections/cloud/gcp_successful_single_factor_authentication.yml @@ -20,7 +20,7 @@ references: tags: analytic_story: - GCP Account Takeover - asset_type: UPDATE asset_type + asset_type: Google Cloud Platform tenant cis20: - CIS 3 - CIS 5