From 24cd1afcb82c062ce31ecb37037ad24a71443eaf Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 12 Aug 2022 12:34:02 -0700
Subject: [PATCH] updatesusing datamodel

---
 .../aws_credential_access_failed_login.yml    | 24 +++++++++----------
 .../aws_credential_access_getpassworddata.yml |  5 ++--
 ...s_credential_access_rds_password_reset.yml |  3 +--
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml
index fd6fc48bfb..5d6a469020 100644
--- a/detections/cloud/aws_credential_access_failed_login.yml
+++ b/detections/cloud/aws_credential_access_failed_login.yml
@@ -5,12 +5,10 @@ date: '2022-08-07'
 author: Gowthamaraj Rajendran, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Authentication
 description: It shows that there have been an unsuccessful attempt to log in using the user identity to the AWS management console. 
   Since the user identity has access to AWS account services and resources, an attacker might try to brute force the password for that identity.
-search: '`cloudtrail` eventName=ConsoleLogin "responseElements.ConsoleLogin"=Failure eventSource="signin.amazonaws.com" | stats
-  count min(_time) as firstTime max(_time) as lastTime values(userIdentity.userName) as Username values(userIdentity.accountId) as AccountID by sourceIPAddress awsRegion eventName userAgent| `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`'
+search: '|  tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure BY Authentication.app Authentication.signature Authentication.dest  Authentication.user Authentication.action Authentication.user_id Authentication.src | `drop_dm_object_name(Authentication)`  | `security_content_ctime(firstTime)`|  `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: Users may genuinely mistype or forget the password.
 references:
@@ -31,17 +29,17 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: User $Username$ has a login failure from IP $sourceIPAddress$
+  message: User $user$ has a login failure from IP $src$
   mitre_attack_id:
   - T1110.001
   nist:
   - DE.CM
   observable:
-  - name: sourceIPAddress
+  - name: src
     type: IP Address
     role:
     - Attacker
-  - name: Username
+  - name: user
     type: User
     role:
     - Victim
@@ -51,12 +49,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time 
-  - eventName
+  - app
   - eventSource
-  - userIdentity.userName
-  - userAgent
-  - userIdentity.accountId
-  - sourceIPAddress
-  - awsRegion
+  - action
+  - signature
+  - dest
+  - user
+  - user_id
   risk_score: 49
   security_domain: threat
diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml
index 4f6c9ea457..10f7109acd 100644
--- a/detections/cloud/aws_credential_access_getpassworddata.yml
+++ b/detections/cloud/aws_credential_access_getpassworddata.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2022-08-10'
 author: Bhavin Patel, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance.
 search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com |  bin _time span=5m |  stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time 
 |  where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`'
@@ -40,7 +39,7 @@ tags:
     type: IP Address
     role:
     - Attacker
-  - name: Username
+  - name: user_arn
     type: User
     role:
     - Victim
diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml
index 57ee6820ee..7346657dec 100644
--- a/detections/cloud/aws_credential_access_rds_password_reset.yml
+++ b/detections/cloud/aws_credential_access_rds_password_reset.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2022-08-07'
 author: Gowthamaraj Rajendran, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. Using this technique, the attacker can get access to the
   sensitive data from the DB. Usually, the production databases may have sensitive data like Credit card information, PII, Health care Data. This event should be 
   investigated further.