admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed the ordering of all detections. This tool previously messed up that order...

Browse Source
This commit is contained in:
pyth0n1c
2022-05-24 13:01:09 -07:00
parent cd6f4c66de
commit 27bb4a28fc
520 changed files with 6340 additions and 6336 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml
+13 -13
View File
@@ -1,13 +1,25 @@
name: Baseline Of Cloud Infrastructure API Calls Per User
id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
version: 1
date: '2020-09-07'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-09-07'
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many API calls are performed by each user. By default, the search uses the
last 90 days of data to build the model and the model is rebuilt weekly. The model
created by this search is then used in the corresponding detection search, which
identifies subsequent outliers in the number of instances created in a small time
window.
search: '| tstats count as api_calls from datamodel=Change.All_Changes where All_Changes.user!=unknown
All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
| eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls)
as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction
api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm
show_density=true'
how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
installed, along with any required dependencies. Depending on the number of users
@@ -17,18 +29,8 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil
90 days of data. You can modify the search window to build the model over a longer
period of time, which may give you better results. You may also want to periodically
re-run this search to rebuild the model with the latest data.
id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
known_false_positives: none
name: Baseline Of Cloud Infrastructure API Calls Per User
references: []
search: '| tstats count as api_calls from datamodel=Change.All_Changes where All_Changes.user!=unknown
All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
| eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls)
as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction
api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm
show_density=true'
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -46,5 +48,3 @@ tags:
- Change.All_Changes.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/baseline_of_cloud_instances_destroyed.yml
+13 -13
View File
@@ -1,13 +1,25 @@
name: Baseline Of Cloud Instances Destroyed
id: a2f701f8-5296-4d74-829c-0b7eb346d549
version: 1
date: '2020-08-25'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-25'
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many instances are destroyed in the environment. By default, the search
uses the last 90 days of data to build the model and the model is rebuilt weekly.
The model created by this search is then used in the corresponding detection search,
which identifies subsequent outliers in the number of instances destroyed in a small
time window.
search: '| tstats count as instances_destroyed from datamodel=Change.All_Changes where
All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance
by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed,
(random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
| eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction
instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1
dist=expon show_density=true'
how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
installed, along with any required dependencies. Depending on the number of users
@@ -19,18 +31,8 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
re-run this search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
id: a2f701f8-5296-4d74-829c-0b7eb346d549
known_false_positives: none
name: Baseline Of Cloud Instances Destroyed
references: []
search: '| tstats count as instances_destroyed from datamodel=Change.All_Changes where
All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance
by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed,
(random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
| eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction
instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1
dist=expon show_density=true'
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -50,5 +52,3 @@ tags:
- Change.All_Changes.status
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/baseline_of_cloud_instances_launched.yml
+13 -13
View File
@@ -1,13 +1,25 @@
name: Baseline Of Cloud Instances Launched
id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
version: 1
date: '2020-08-14'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-14'
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many instances are created in the environment. By default, the search uses
the last 90 days of data to build the model and the model is rebuilt weekly. The
model created by this search is then used in the corresponding detection search,
which identifies subsequent outliers in the number of instances created in a small
time window.
search: '| tstats count as instances_launched from datamodel=Change.All_Changes where
(All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance
by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
(random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
| eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
dist=expon show_density=true'
how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
installed, along with any required dependencies. Depending on the number of users
@@ -19,18 +31,8 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
re-run this search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
known_false_positives: none
name: Baseline Of Cloud Instances Launched
references: []
search: '| tstats count as instances_launched from datamodel=Change.All_Changes where
(All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance
by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
(random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
| eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
dist=expon show_density=true'
tags:
analytic_story:
- Cloud Cryptomining
@@ -50,5 +52,3 @@ tags:
- Change.All_Changes.status
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml
+16 -16
View File
@@ -1,24 +1,15 @@
name: Baseline Of Cloud Security Group API Calls Per User
id: 67b84d51-8329-4909-849f-8d38ce54260a
version: 1
date: '2020-09-07'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-09-07'
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many API calls for security groups are performed by each user. By default,
the search uses the last 90 days of data to build the model and the model is rebuilt
weekly.
how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
installed, along with any required dependencies. Depending on the number of users
in your environment, you may also need to adjust the value for max_inputs in the
MLTK settings for the DensityFunction algorithm, then ensure that the search completes
in a reasonable timeframe. By default, the search builds the model using the past
90 days of data. You can modify the search window to build the model over a longer
period of time, which may give you better results. You may also want to periodically
re-run this search to rebuild the model with the latest data.
id: 67b84d51-8329-4909-849f-8d38ce54260a
known_false_positives: none
name: Baseline Of Cloud Security Group API Calls Per User
references: []
search: '| tstats count as security_group_api_calls from datamodel=Change.All_Changes
where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user
_time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time,
@@ -28,6 +19,17 @@ search: '| tstats count as security_group_api_calls from datamodel=Change.All_Ch
by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction
security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1
dist=norm show_density=true'
how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
installed, along with any required dependencies. Depending on the number of users
in your environment, you may also need to adjust the value for max_inputs in the
MLTK settings for the DensityFunction algorithm, then ensure that the search completes
in a reasonable timeframe. By default, the search builds the model using the past
90 days of data. You can modify the search window to build the model over a longer
period of time, which may give you better results. You may also want to periodically
re-run this search to rebuild the model with the latest data.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -46,5 +48,3 @@ tags:
- Change.All_Changes.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/baseline_of_network_acl_activity_by_arn.yml
+11 -11
View File
@@ -1,23 +1,25 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Baseline of Network ACL Activity by ARN
id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
version: 1
date: '2018-05-21'
author: Bhavin Patel, Splunk
type: Baseline
datamodel: []
description: This search establishes, on a per-hour basis, the average and the standard
deviation of the number of API calls that were related to network ACLs made by each
user. Also recorded is the number of data points for each user. This table is then
outputted to a lookup file to allow the detection search to operate quickly.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
known_false_positives: none
name: Baseline of Network ACL Activity by ARN
references: []
search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
known_false_positives: none
references: []
tags:
analytic_story:
- AWS Network ACL Activity
@@ -32,5 +34,3 @@ tags:
required_fields:
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml
+11 -11
View File
@@ -1,22 +1,24 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Baseline of S3 Bucket deletion activity by ARN
id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
version: 1
date: '2018-07-17'
author: Bhavin Patel, Splunk
type: Baseline
datamodel: []
description: This search establishes, on a per-hour basis, the average and standard
deviation for the number of API calls related to deleting an S3 bucket by each user.
Also recorded is the number of data points for each user. This table is then outputted
to a lookup file to allow the detection search to operate quickly.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs.
id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
known_false_positives: none
name: Baseline of S3 Bucket deletion activity by ARN
references: []
search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious AWS S3 Activities
@@ -31,5 +33,3 @@ tags:
required_fields:
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/baseline_of_security_group_activity_by_arn.yml
+11 -11
View File
@@ -1,23 +1,25 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Baseline of Security Group Activity by ARN
id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
version: 1
date: '2018-04-17'
author: Bhavin Patel, Splunk
type: Baseline
datamodel: []
description: This search establishes, on a per-hour basis, the average and the standard
deviation for the number of API calls related to security groups made by each user.
Also recorded is the number of data points for each user. This table is then outputted
to a lookup file to allow the detection search to operate quickly.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
known_false_positives: none
name: Baseline of Security Group Activity by ARN
references: []
search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats
count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
known_false_positives: none
references: []
tags:
analytic_story:
- AWS User Monitoring
@@ -32,5 +34,3 @@ tags:
required_fields:
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/circle_ci_disable_security_job.yml
+10 -10
View File
@@ -1,12 +1,11 @@
author: Patrick Bareiss, Splunk
datamodel: []
date: '2021-09-02'
description: This search looks for disable security job in CircleCI pipeline.
how_to_implement: You must index CircleCI logs.
id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
known_false_positives: unknown
name: Circle CI Disable Security Job
references: []
id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
version: 1
date: '2021-09-02'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
description: This search looks for disable security job in CircleCI pipeline.
search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
@@ -14,6 +13,9 @@ search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_me
mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
mandatory_job_executed=0 | eval phase="build" | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
@@ -48,5 +50,3 @@ tags:
required_fields: []
risk_score: 72
security_domain: network
type: Anomaly
version: 1
detections/cloud/circle_ci_disable_security_step.yml
+10 -10
View File
@@ -1,12 +1,11 @@
author: Patrick Bareiss, Splunk
datamodel: []
date: '2021-09-01'
description: This search looks for disable security step in CircleCI pipeline.
how_to_implement: You must index CircleCI logs.
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
known_false_positives: unknown
name: Circle CI Disable Security Step
references: []
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
version: 1
date: '2021-09-01'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
description: This search looks for disable security step in CircleCI pipeline.
search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci`
| stats values(name) as step_names count by job_id job_name ] | stats count by step_names
job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
@@ -15,6 +14,9 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url
"(?<repository>[^\/]*\/[^\/]*)$" | eval phase="build" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
@@ -48,5 +50,3 @@ tags:
required_fields: []
risk_score: 72
security_domain: network
type: Anomaly
version: 1
detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+15 -15
View File
@@ -1,20 +1,12 @@
name: Cloud API Calls From Previously Unseen User Roles
id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
version: 1
date: '2020-09-04'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-09-04'
description: This search looks for new commands from each user role.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud API Calls Per
User Role - Initial` to build the initial table of user roles, commands, and times.
You must also enable the second baseline search `Previously Seen Cloud API Calls
Per User Role - Update` to keep this table up to date and to age out old data. You
can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
macro. You can also provide additional filtering for this search by customizing
the `cloud_api_calls_from_previously_unseen_user_roles_filter`
id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
known_false_positives: .
name: Cloud API Calls From Previously Unseen User Roles
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` |
@@ -24,6 +16,16 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user,
object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`cloud_api_calls_from_previously_unseen_user_roles_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud API Calls Per
User Role - Initial` to build the initial table of user roles, commands, and times.
You must also enable the second baseline search `Previously Seen Cloud API Calls
Per User Role - Update` to keep this table up to date and to age out old data. You
can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
macro. You can also provide additional filtering for this search by customizing
the `cloud_api_calls_from_previously_unseen_user_roles_filter`
known_false_positives: .
references: []
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -66,5 +68,3 @@ tags:
- _time
risk_score: 36
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+12 -12
View File
@@ -1,18 +1,13 @@
name: Cloud Compute Instance Created By Previously Unseen User
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
version: 2
date: '2021-07-13'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Change
date: '2021-07-13'
description: This search looks for cloud compute instances created by users who have
not created them before.
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
Run the "Previously Seen Cloud Compute Creations By User" support search to create
of baseline of previously seen users.
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
known_false_positives: It's possible that a user will start to create compute instances
for the first time, for any number of reasons. Verify with the user launching instances
that this is the intended behavior.
name: Cloud Compute Instance Created By Previously Unseen User
references: []
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change.All_Changes
where All_Changes.action=created by All_Changes.user All_Changes.vendor_region |
@@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
| table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_by_previously_unseen_user_filter`'
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
Run the "Previously Seen Cloud Compute Creations By User" support search to create
of baseline of previously seen users.
known_false_positives: It's possible that a user will start to create compute instances
for the first time, for any number of reasons. Verify with the user launching instances
that this is the intended behavior.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -67,5 +69,3 @@ tags:
- _time
risk_score: 18
security_domain: threat
type: Anomaly
version: 2
detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+15 -15
View File
@@ -1,22 +1,14 @@
name: Cloud Compute Instance Created In Previously Unused Region
id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
version: 1
date: '2020-09-02'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-09-02'
description: This search looks at cloud-infrastructure events where an instance is
created in any region within the last hour and then compares it to a lookup file
of previously seen regions where instances have been created.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
to build the initial table of images observed and times. You must also enable the
second baseline search `Previously Seen Cloud Regions - Update` to keep this table
up to date and to age out old data. You can also provide additional filtering for
this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter`
macro.
id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
known_false_positives: It's possible that a user has unknowingly started an instance
in a new region. Please verify that this activity is legitimate.
name: Cloud Compute Instance Created In Previously Unused Region
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change.All_Changes where All_Changes.action=created
by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")`
@@ -25,6 +17,16 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(
enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user,
dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
to build the initial table of images observed and times. You must also enable the
second baseline search `Previously Seen Cloud Regions - Update` to keep this table
up to date and to age out old data. You can also provide additional filtering for
this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter`
macro.
known_false_positives: It's possible that a user has unknowingly started an instance
in a new region. Please verify that this activity is legitimate.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -72,5 +74,3 @@ tags:
- _time
risk_score: 42
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+16 -16
View File
@@ -1,22 +1,13 @@
name: Cloud Compute Instance Created With Previously Unseen Image
id: bc24922d-987c-4645-b288-f8c73ec194c4
version: 1
date: '2018-10-12'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
date: '2018-10-12'
description: This search looks for cloud compute instances being created with previously
unseen image IDs.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Images
- Initial` to build the initial table of images observed and times. You must also
enable the second baseline search `Previously Seen Cloud Compute Images - Update`
to keep this table up to date and to age out old data. You can also provide additional
filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter`
macro.
id: bc24922d-987c-4645-b288-f8c73ec194c4
known_false_positives: After a new image is created, the first systems created with
that image will cause this alert to fire. Verify that the image being used was
created by a legitimate user.
name: Cloud Compute Instance Created With Previously Unseen Image
references: []
search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -25,6 +16,17 @@ search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime
| where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage)
OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user,
image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Images
- Initial` to build the initial table of images observed and times. You must also
enable the second baseline search `Previously Seen Cloud Compute Images - Update`
to keep this table up to date and to age out old data. You can also provide additional
filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter`
macro.
known_false_positives: After a new image is created, the first systems created with
that image will cause this alert to fire. Verify that the image being used was
created by a legitimate user.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -66,5 +68,3 @@ tags:
- _time
risk_score: 36
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+16 -16
View File
@@ -1,21 +1,12 @@
name: Cloud Compute Instance Created With Previously Unseen Instance Type
id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
version: 1
date: '2020-09-12'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-09-12'
description: Find EC2 instances being created with previously unseen instance types.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Instance
Types - Initial` to build the initial table of instance types observed and times.
You must also enable the second baseline search `Previously Seen Cloud Compute Instance
Types - Update` to keep this table up to date and to age out old data. You can also
provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
macro.
id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
known_false_positives: It is possible that an admin will create a new system using
a new instance type that has never been used before. Verify with the creator that
they intended to create the system with the new instance type.
name: Cloud Compute Instance Created With Previously Unseen Instance Type
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change.All_Changes where All_Changes.action=created
by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("All_Changes")`
@@ -26,6 +17,17 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values
isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(),
"-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Instance
Types - Initial` to build the initial table of instance types observed and times.
You must also enable the second baseline search `Previously Seen Cloud Compute Instance
Types - Update` to keep this table up to date and to age out old data. You can also
provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
macro.
known_false_positives: It is possible that an admin will create a new system using
a new instance type that has never been used before. Verify with the creator that
they intended to create the system with the new instance type.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -67,5 +69,3 @@ tags:
- _time
risk_score: 30
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+13 -13
View File
@@ -1,19 +1,13 @@
name: Cloud Instance Modified By Previously Unseen User
id: 7fb15084-b14e-405a-bd61-a6de15a40722
version: 1
date: '2020-07-29'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-07-29'
description: This search looks for cloud instances being modified by users who have
not previously modified them.
how_to_implement: This search has a dependency on other searches to create and update
a baseline of users observed to be associated with this activity. The search "Previously
Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
to properly work.
id: 7fb15084-b14e-405a-bd61-a6de15a40722
known_false_positives: It's possible that a new user will start to modify EC2 instances
when they haven't before for any number of reasons. Verify with the user that is
modifying instances that this is the intended behavior.
name: Cloud Instance Modified By Previously Unseen User
references: []
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
as command from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2
@@ -23,6 +17,14 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser)
OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command
object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`'
how_to_implement: This search has a dependency on other searches to create and update
a baseline of users observed to be associated with this activity. The search "Previously
Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
to properly work.
known_false_positives: It's possible that a new user will start to modify EC2 instances
when they haven't before for any number of reasons. Verify with the user that is
modifying instances that this is the intended behavior.
references: []
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -69,5 +71,3 @@ tags:
- _time
risk_score: 42
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
+15 -15
View File
@@ -1,10 +1,24 @@
name: Cloud Provisioning Activity From Previously Unseen City
id: e7ecc5e0-88df-48b9-91af-51104c68f02f
version: 1
date: '2020-10-09'
author: Rico Valdez, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-10-09'
description: This search looks for cloud provisioning activities from previously unseen
cities. Provisioning activities are defined broadly as any event that runs or creates
something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |
lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen,
enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 |
eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity
> relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) |
table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -14,7 +28,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter`
macro.
id: e7ecc5e0-88df-48b9-91af-51104c68f02f
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -26,18 +39,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen City
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |
lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen,
enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 |
eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity
> relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) |
table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -88,5 +90,3 @@ tags:
- _time
risk_score: 18
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+15 -15
View File
@@ -1,10 +1,24 @@
name: Cloud Provisioning Activity From Previously Unseen Country
id: 94994255-3acf-4213-9b3f-0494df03bb31
version: 1
date: '2020-10-09'
author: Rico Valdez, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-10-09'
description: This search looks for cloud provisioning activities from previously unseen
countries. Provisioning activities are defined broadly as any event that runs or
creates something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country
OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -14,7 +28,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter`
macro.
id: 94994255-3acf-4213-9b3f-0494df03bb31
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -26,18 +39,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen Country
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country
OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -88,5 +90,3 @@ tags:
- _time
risk_score: 42
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
+14 -14
View File
@@ -1,10 +1,23 @@
name: Cloud Provisioning Activity From Previously Unseen IP Address
id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
version: 1
date: '2020-08-16'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-08-16'
description: This search looks for cloud provisioning activities from previously unseen
IP addresses. Provisioning activities are defined broadly as any event that runs
or creates something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
as object_id from datamodel=Change.All_Changes where (All_Changes.action=started
OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user,
All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
| where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -14,7 +27,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
macro.
id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -26,17 +38,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen IP Address
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
as object_id from datamodel=Change.All_Changes where (All_Changes.action=started
OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user,
All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
| where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -87,5 +89,3 @@ tags:
- _time
risk_score: 42
security_domain: threat
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
+15 -15
View File
@@ -1,10 +1,24 @@
name: Cloud Provisioning Activity From Previously Unseen Region
id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
version: 1
date: '2020-08-16'
author: Rico Valdez, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Change
date: '2020-08-16'
description: This search looks for cloud provisioning activities from previously unseen
regions. Provisioning activities are defined broadly as any event that runs or creates
something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)
| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -14,7 +28,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter`
macro.
id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -26,18 +39,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen Region
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)
| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -88,5 +90,3 @@ tags:
- _time
risk_score: 42
security_domain: threat
type: Anomaly
version: 1
detections/cloud/correlation_by_repository_and_risk.yml
+10 -10
View File
@@ -1,15 +1,17 @@
author: Patrick Bareiss, Splunk
datamodel: []
date: '2021-09-06'
description: This search correlations detections by repository and risk_score
how_to_implement: For Dev Sec Ops POC
id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
known_false_positives: unknown
name: Correlation by Repository and Risk
references: []
id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
version: 1
date: '2021-09-06'
author: Patrick Bareiss, Splunk
type: Correlation
datamodel: []
description: This search correlations detections by repository and risk_score
search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source)
as signals values(user) as user by repository | sort - risk_score | where risk_score
> 80 | `correlation_by_repository_and_risk_filter`'
how_to_implement: For Dev Sec Ops POC
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
@@ -43,5 +45,3 @@ tags:
required_fields: []
risk_score: 70
security_domain: network
type: Correlation
version: 1
detections/cloud/correlation_by_user_and_risk.yml
+10 -10
View File
@@ -1,15 +1,17 @@
author: Patrick Bareiss, Splunk
datamodel: []
date: '2021-09-06'
description: This search correlations detections by user and risk_score
how_to_implement: For Dev Sec Ops POC
id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
known_false_positives: unknown
name: Correlation by User and Risk
references: []
id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
version: 1
date: '2021-09-06'
author: Patrick Bareiss, Splunk
type: Correlation
datamodel: []
description: This search correlations detections by user and risk_score
search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source)
as signals values(repository) as repository by user | sort - risk_score | where
risk_score > 80 | `correlation_by_user_and_risk_filter`'
how_to_implement: For Dev Sec Ops POC
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
@@ -43,5 +45,3 @@ tags:
required_fields: []
risk_score: 70
security_domain: network
type: Correlation
version: 1
detections/cloud/create_a_list_of_approved_aws_service_accounts.yml
+9 -9
View File
@@ -1,21 +1,23 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Create a list of approved AWS service accounts
id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
version: 2
date: '2018-12-03'
author: Bhavin Patel, Splunk
type: Baseline
datamodel: []
description: This search looks for successful API activity in CloudTrail within the
last 30 days, filters out known users from the identity table, and outputs values
of users into `aws_service_accounts.csv` lookup file.
search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
[inputlookup identity_lookup_expanded | fields identity] | stats count by identity
| table identity | outputlookup aws_service_accounts | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Please validate the service account entires in `aws_service_accounts.csv`,
which is a lookup file created as a result of running this support search. Please
remove the entries of service accounts that are not legitimate.
id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
known_false_positives: none
name: Create a list of approved AWS service accounts
references: []
search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
[inputlookup identity_lookup_expanded | fields identity] | stats count by identity
| table identity | outputlookup aws_service_accounts | stats count'
tags:
analytic_story:
- AWS User Monitoring
@@ -31,5 +33,3 @@ tags:
- errorCode
- userName
security_domain: network
type: Baseline
version: 2
detections/cloud/detect_aws_console_login_by_new_user.yml
+16 -16
View File
@@ -1,25 +1,16 @@
name: Detect AWS Console Login by New User
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
version: 1
date: '2020-05-28'
author: Rico Valdez, Splunk
type: Hunting
datamodel:
- Authentication
date: '2020-05-28'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines.
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by New User
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
| join user type=outer [ inputlookup previously_seen_users_console_logins | stats
@@ -27,6 +18,17 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
"-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -65,5 +67,3 @@ tags:
- _time
risk_score: 30
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+18 -18
View File
@@ -1,27 +1,16 @@
name: Detect AWS Console Login by User from New City
id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
type: Hunting
datamodel:
- Authentication
date: '2020-10-07'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
macro.
id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by User from New City
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -32,6 +21,19 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND
userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
macro.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious AWS Login Activities
@@ -75,5 +77,3 @@ tags:
- _time
risk_score: 18
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+18 -18
View File
@@ -1,27 +1,16 @@
name: Detect AWS Console Login by User from New Country
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
type: Hunting
datamodel:
- Authentication
date: '2020-10-07'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
macro.
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by User from New Country
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -32,6 +21,19 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"
AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
macro.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious AWS Login Activities
@@ -75,5 +77,3 @@ tags:
- _time
risk_score: 42
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+18 -18
View File
@@ -1,27 +1,16 @@
name: Detect AWS Console Login by User from New Region
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
type: Hunting
datamodel:
- Authentication
date: '2020-10-07'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
macro.
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by User from New Region
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -32,6 +21,19 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region"
AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
macro.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious AWS Login Activities
@@ -75,5 +77,3 @@ tags:
- _time
risk_score: 36
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_new_open_s3_buckets.yml
+12 -12
View File
@@ -1,16 +1,12 @@
author: Bhavin Patel, Patrick Bareiss, Splunk
datamodel: []
name: Detect New Open S3 buckets
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
version: 3
date: '2021-07-19'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket.
how_to_implement: You must install the AWS App for Splunk.
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
name: Detect New Open S3 buckets
references: []
search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
"(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
| search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI
@@ -20,6 +16,12 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission
bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `detect_new_open_s3_buckets_filter` '
how_to_implement: You must install the AWS App for Splunk.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
references: []
tags:
analytic_story:
- Suspicious AWS S3 Activities
@@ -70,5 +72,3 @@ tags:
- user_arn
risk_score: 48
security_domain: threat
type: TTP
version: 3
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+12 -12
View File
@@ -1,16 +1,12 @@
author: Patrick Bareiss, Splunk
datamodel: []
name: Detect New Open S3 Buckets over AWS CLI
id: 39c61d09-8b30-4154-922b-2d0a694ecc22
version: 2
date: '2021-07-19'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket over the aws cli.
how_to_implement: ''
id: 39c61d09-8b30-4154-922b-2d0a694ecc22
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
name: Detect New Open S3 Buckets over AWS CLI
references: []
search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli*
) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
@@ -22,6 +18,12 @@ search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR u
requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write
requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` '
how_to_implement: ''
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
references: []
tags:
analytic_story:
- Suspicious AWS S3 Activities
@@ -72,5 +74,3 @@ tags:
- userAgent
risk_score: 48
security_domain: threat
type: TTP
version: 2
detections/cloud/detect_shared_ec2_snapshot.yml
+12 -12
View File
@@ -1,21 +1,23 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Detect shared ec2 snapshot
id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
version: 2
date: '2021-07-20'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
description: The following analytic utilizes AWS CloudTrail events to identify when
an EC2 snapshot permissions are modified to be shared with a different AWS account.
This method is used by adversaries to exfiltrate the EC2 snapshot.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
known_false_positives: It is possible that an AWS admin has legitimately shared a
snapshot with others for a specific purpose.
name: Detect shared ec2 snapshot
references:
- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` '
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS admin has legitimately shared a
snapshot with others for a specific purpose.
references:
- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -68,5 +70,3 @@ tags:
- vendor_region
risk_score: 48
security_domain: threat
type: TTP
version: 2
detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+12 -12
View File
@@ -1,16 +1,12 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
version: 3
date: '2021-01-26'
author: Bhavin Patel, Splunk
type: Anomaly
datamodel: []
description: This search looks for a spike in number of of AWS security Hub alerts
for an EC2 instance in 4 hours intervals
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
Hub inputs. The threshold_value should be tuned to your environment and schedule
these searches according to the bucket span interval.
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
known_false_positives: None
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
references: []
search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
_time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
as vendor_account values(vendor_region) as vendor_region values(severity) as severity
@@ -18,6 +14,12 @@ search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket sp
| eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
* threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
Hub inputs. The threshold_value should be tuned to your environment and schedule
these searches according to the bucket span interval.
known_false_positives: None
references: []
tags:
analytic_story:
- AWS Security Hub Alerts
@@ -55,5 +57,3 @@ tags:
- vendor_region
risk_score: 15
security_domain: endpoint
type: Anomaly
version: 3
detections/cloud/gcp_kubernetes_activity_by_src_ip.yml
+12 -12
View File
@@ -1,17 +1,13 @@
author: Rod Soto, Splunk
datamodel: []
name: GCP Kubernetes activity by src ip
id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f
version: 1
date: '2020-04-13'
author: Rod Soto, Splunk
type: Investigation
datamodel: []
description: This search provides investigation data about requests via user agent,
authentication request URI, resource path and cluster name data against Kubernetes
cluster from a specific IP address
how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later),
then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection
to filter out FPs.
id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f
known_false_positives: ''
name: GCP Kubernetes activity by src ip
references: []
search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp
as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time)
as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName)
@@ -19,6 +15,12 @@ search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.
as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as
user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name
data.resource.type'
how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later),
then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection
to filter out FPs.
known_false_positives: ''
references: []
tags:
analytic_story:
- Kubernetes Scanning Activity
@@ -27,5 +29,3 @@ tags:
required_fields:
- _time
security_domain: network
type: Investigation
version: 1
detections/cloud/get_all_aws_activity_from_city.yml
+11 -11
View File
@@ -1,21 +1,23 @@
author: David Dorsey, Splunk
datamodel: []
name: Get All AWS Activity From City
id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8
version: 1
date: '2018-03-19'
author: David Dorsey, Splunk
type: Investigation
datamodel: []
description: This search retrieves all the activity from a specific city and will
create a table containing the time, city, ARN, username, the type of user, the source
IP address, the AWS region the activity was in, the API called, and whether or not
the API call was successful.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8
known_false_positives: ''
name: Get All AWS Activity From City
references: []
search: '`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user
path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath
output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table
_time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
known_false_positives: ''
references: []
tags:
analytic_story:
- AWS Suspicious Provisioning Activities
@@ -29,5 +31,3 @@ tags:
- eventName
- sourceIPAddress
security_domain: network
type: Investigation
version: 1
detections/cloud/get_all_aws_activity_from_country.yml
+11 -11
View File
@@ -1,22 +1,24 @@
author: David Dorsey, Splunk
datamodel: []
name: Get All AWS Activity From Country
id: e763cdb9-00da-41e0-9bda-444debc9501a
version: 1
date: '2018-03-19'
author: David Dorsey, Splunk
type: Investigation
datamodel: []
description: This search retrieves all the activity from a specific country and will
create a table containing the time, country, ARN, username, the type of user, the
source IP address, the AWS region the activity was in, the API called, and whether
or not the API call was successful.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: e763cdb9-00da-41e0-9bda-444debc9501a
known_false_positives: ''
name: Get All AWS Activity From Country
references: []
search: '`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath
output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
| spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
| table _time, Country, user, userName, userType, src_ip, awsRegion, eventName,
errorCode'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
known_false_positives: ''
references: []
tags:
analytic_story:
- AWS Suspicious Provisioning Activities
@@ -30,5 +32,3 @@ tags:
- eventName
- sourceIPAddress
security_domain: network
type: Investigation
version: 1
detections/cloud/get_all_aws_activity_from_ip_address.yml
+11 -11
View File
@@ -1,21 +1,23 @@
author: David Dorsey, Splunk
datamodel: []
name: Get All AWS Activity From IP Address
id: 446ec87a-85c6-40d4-b060-bea4498281d6
version: 1
date: '2018-03-19'
author: David Dorsey, Splunk
type: Investigation
datamodel: []
description: This search retrieves all the activity from a specific IP address and
will create a table containing the time, ARN, username, the type of user, the IP
address, the AWS region the activity was in, the API called, and whether or not
the API call was successful.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: 446ec87a-85c6-40d4-b060-bea4498281d6
known_false_positives: ''
name: Get All AWS Activity From IP Address
references: []
search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath
output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
| spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
| table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
known_false_positives: ''
references: []
tags:
analytic_story:
- AWS Network ACL Activity
@@ -34,5 +36,3 @@ tags:
- eventName
- sourceIPAddress
security_domain: network
type: Investigation
version: 1
detections/cloud/get_all_aws_activity_from_region.yml
+11 -11
View File
@@ -1,21 +1,23 @@
author: David Dorsey, Splunk
datamodel: []
name: Get All AWS Activity From Region
id: 5b794bef-1743-4f6f-804a-43915a2702ff
version: 1
date: '2018-03-19'
author: David Dorsey, Splunk
type: Investigation
datamodel: []
description: This search retrieves all the activity from a specific geographic region
and will create a table containing the time, geographic region, ARN, username, the
type of user, the source IP address, the AWS region the activity was in, the API
called, and whether or not the API call was successful.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: 5b794bef-1743-4f6f-804a-43915a2702ff
known_false_positives: ''
name: Get All AWS Activity From Region
references: []
search: '`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath
output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
| spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
| table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
known_false_positives: ''
references: []
tags:
analytic_story:
- AWS Suspicious Provisioning Activities
@@ -29,5 +31,3 @@ tags:
- eventName
- sourceIPAddress
security_domain: network
type: Investigation
version: 1
detections/cloud/get_ec2_launch_details.yml
+12 -12
View File
@@ -1,19 +1,21 @@
author: Bhavin Patel, Splunk
datamodel: []
date: '2018-03-12'
description: This search returns some of the launch details for a EC2 instance.
how_to_implement: In order to implement this search, you must install the AWS App
for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
and configure your AWS description inputs.
id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
known_false_positives: ''
name: Get EC2 Launch Details
references: []
id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
version: 1
date: '2018-03-12'
author: Bhavin Patel, Splunk
type: Investigation
datamodel: []
description: This search returns some of the launch details for a EC2 instance.
search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId
as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress,
responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName'
how_to_implement: In order to implement this search, you must install the AWS App
for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
and configure your AWS description inputs.
known_false_positives: ''
references: []
tags:
analytic_story:
- AWS Cryptomining
@@ -26,5 +28,3 @@ tags:
required_fields:
- dest
security_domain: network
type: Investigation
version: 1
detections/cloud/github_commit_changes_in_master.yml
+1 -1
View File
@@ -39,9 +39,9 @@ tags:
- T1199
observable:
- name: commit.commit.author.email
type: User
role:
- attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/github_commit_in_develop.yml
+1 -1
View File
@@ -38,9 +38,9 @@ tags:
- T1199
observable:
- name: commit.commit.author.email
type: User
role:
- attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/github_dependabot_alert.yml
+12 -12
View File
@@ -1,20 +1,22 @@
author: Patrick Bareiss, Splunk
datamodel: []
date: '2021-09-01'
description: This search looks for Dependabot Alerts in Github logs.
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
id: 05032b04-4469-4034-9df7-05f607d75cba
known_false_positives: unknown
name: GitHub Dependabot Alert
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
id: 05032b04-4469-4034-9df7-05f607d75cba
version: 1
date: '2021-09-01'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
description: This search looks for Dependabot Alerts in Github logs.
search: '`github` alert.id=* action=create | rename repository.full_name as repository,
repository.html_url as repository_url sender.login as user | stats min(_time) as
firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range
alert.created_at alert.external_identifier alert.external_reference alert.fixed_in
alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
known_false_positives: unknown
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
tags:
analytic_story:
- Dev Sec Ops
@@ -51,5 +53,3 @@ tags:
- action
risk_score: 27
security_domain: network
type: Anomaly
version: 1
detections/cloud/github_pull_request_from_unknown_user.yml
+12 -12
View File
@@ -1,20 +1,22 @@
author: Patrick Bareiss, Splunk
datamodel: []
date: '2021-09-01'
description: This search looks for Pull Request from unknown user.
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
id: 9d7b9100-8878-4404-914e-ca5e551a641e
known_false_positives: unknown
name: GitHub Pull Request from Unknown User
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
id: 9d7b9100-8878-4404-914e-ca5e551a641e
version: 1
date: '2021-09-01'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
description: This search looks for Pull Request from unknown user.
search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message
| rename check_suite.head_commit.author.name as user repository.full_name as repository
check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message
as commit_message | search NOT `github_known_users` | eval phase="code" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
known_false_positives: unknown
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
tags:
analytic_story:
- Dev Sec Ops
@@ -49,5 +51,3 @@ tags:
required_fields: []
risk_score: 27
security_domain: network
type: Anomaly
version: 1
detections/cloud/gsuite_drive_share_in_external_email.yml
+15 -15
View File
@@ -1,20 +1,13 @@
author: Teoderick Contreras, Splunk
datamodel: []
name: Gsuite Drive Share In External Email
id: f6ee02d6-fea0-11eb-b2c2-acde48001122
version: 1
date: '2021-08-16'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
description: This search is to detect suspicious google drive or google docs files
shared outside or externally. This behavior might be a good hunting query to monitor
exfitration of data made by an attacker or insider to a targetted machine.
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
id: f6ee02d6-fea0-11eb-b2c2-acde48001122
known_false_positives: network admin or normal user may share files to customer and
external team.
name: Gsuite Drive Share In External Email
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"
| rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com"
and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low"
@@ -24,6 +17,15 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
lastTime by parameters.owner ip_address phase severity | rename parameters.owner
as user ip_address as src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_drive_share_in_external_email_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
known_false_positives: network admin or normal user may share files to customer and
external team.
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- Dev Sec Ops
@@ -63,5 +65,3 @@ tags:
- src_domain
risk_score: 72
security_domain: endpoint
type: Anomaly
version: 1
detections/cloud/gsuite_email_suspicious_attachment.yml
+14 -14
View File
@@ -1,21 +1,15 @@
author: Teoderick Contreras, Splunk
datamodel: []
name: GSuite Email Suspicious Attachment
id: 6d663014-fe92-11eb-ab07-acde48001122
version: 1
date: '2021-08-16'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
description: This search is to detect a suspicious attachment file extension in Gsuite
email that may related to spear phishing attack. This file type is commonly used
by malware to lure user to click on it to execute malicious code to compromised
targetted machine. But this search can also catch some normal files related to this
file type that maybe send by employee or network admin.
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.
id: 6d663014-fe92-11eb-ab07-acde48001122
known_false_positives: network admin and normal user may send this file attachment
as part of their day to day work. having a good protocol in attaching this file
type to an e-mail may reduce the risk of having a spear phishing attack.
name: GSuite Email Suspicious Attachment
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh",
"bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
| eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime
@@ -24,6 +18,14 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb",
by destination{}.service num_message_attachments subject destination{}.address
source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_email_suspicious_attachment_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.
known_false_positives: network admin and normal user may send this file attachment
as part of their day to day work. having a good protocol in attaching this file
type to an e-mail may reduce the risk of having a spear phishing attack.
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- Dev Sec Ops
@@ -61,5 +63,3 @@ tags:
- subject
risk_score: 49
security_domain: endpoint
type: Anomaly
version: 1
detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
+2 -2
View File
@@ -43,13 +43,13 @@ tags:
- T1048
observable:
- name: source.address
type: User
role:
- attacker
- name: destination{}.address
type: User
- name: destination{}.address
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/gsuite_suspicious_shared_file_name.yml
+16 -16
View File
@@ -1,24 +1,16 @@
author: Teoderick Contreras, Splunk
datamodel: []
name: Gsuite Suspicious Shared File Name
id: 07eed200-03f5-11ec-98fb-acde48001122
version: 1
date: '2021-08-23'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
description: This search is to detect a shared file in google drive with suspicious
file name that are commonly used by spear phishing campaign. This technique is very
popular to lure the user by running a malicious document or click a malicious link
within the shared file that will redirected to malicious website. This detection
can also catch some normal email communication between organization and its external
customer.
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
id: 07eed200-03f5-11ec-98fb-acde48001122
known_false_positives: normal user or normal transaction may contain the subject and
file type attachment that this detection try to search
name: Gsuite Suspicious Shared File Name
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*",
"*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*",
@@ -30,6 +22,16 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
parameters.target_user parameters.doc_title parameters.doc_type phase severity |
rename parameters.target_user AS user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_suspicious_shared_file_name_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
known_false_positives: normal user or normal transaction may contain the subject and
file type attachment that this detection try to search
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
tags:
analytic_story:
- Dev Sec Ops
@@ -67,5 +69,3 @@ tags:
- email
risk_score: 21
security_domain: endpoint
type: Anomaly
version: 1
detections/cloud/investigate_aws_activities_via_region_name.yml
+8 -8
View File
@@ -1,18 +1,20 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Investigate AWS activities via region name
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
version: 1
date: '2018-02-09'
author: Bhavin Patel, Splunk
type: Investigation
datamodel: []
description: This search lists all the user activities logged by CloudTrail for a
specific region in question and will create a table of the values of parameters
requested, the type of the event and the response from the AWS API by each user
search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId
as instanceId | stats values(eventName) by user instanceId vendor_region'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
known_false_positives: ''
name: Investigate AWS activities via region name
references: []
search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId
as instanceId | stats values(eventName) by user instanceId vendor_region'
tags:
analytic_story:
- AWS Cryptomining
@@ -27,5 +29,3 @@ tags:
- user
- vendor_region
security_domain: network
type: Investigation
version: 1
detections/cloud/investigate_aws_user_activities_by_user_field.yml
+8 -8
View File
@@ -1,19 +1,21 @@
author: Bhavin Patel, Splunk
datamodel: []
name: Investigate AWS User Activities by user field
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
version: 1
date: '2018-03-12'
author: Bhavin Patel, Splunk
type: Investigation
datamodel: []
description: This search lists all the logged CloudTrail activities by a specific
user and will create a table containing the source of the user, the region of the
activity, the name and type of the event, the action taken, and the user's identity
information.
search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName
userIdentity.arn aws_account_id src awsRegion eventName eventType '
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
known_false_positives: ''
name: Investigate AWS User Activities by user field
references: []
search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName
userIdentity.arn aws_account_id src awsRegion eventName eventType '
tags:
analytic_story:
- AWS User Monitoring
@@ -30,5 +32,3 @@ tags:
- src
- user
security_domain: network
type: Investigation
version: 1
detections/cloud/investigate_okta_activity_by_app.yml
+10 -10
View File
@@ -1,15 +1,17 @@
author: Rico Valdez, Splunk
datamodel: []
date: '2020-04-02'
description: This search returns all okta events associated with a specific app
how_to_implement: You must be ingesting Okta logs
id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
known_false_positives: ''
name: Investigate Okta Activity by app
references: []
id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
version: 1
date: '2020-04-02'
author: Rico Valdez, Splunk
type: Investigation
datamodel: []
description: This search returns all okta events associated with a specific app
search: '`okta` app=$app$ | rename client.geographicalContext.country as country,
client.geographicalContext.state as state, client.geographicalContext.city as city
| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
how_to_implement: You must be ingesting Okta logs
known_false_positives: ''
references: []
tags:
analytic_story:
- Suspicious Okta Activity
@@ -23,5 +25,3 @@ tags:
- src_ip
- user
security_domain: network
type: Investigation
version: 1
detections/cloud/investigate_okta_activity_by_ip_address.yml
+10 -10
View File
@@ -1,15 +1,17 @@
author: Rico Valdez, Splunk
datamodel: []
date: '2020-04-02'
description: This search returns all okta events from a specific IP address.
how_to_implement: You must be ingesting Okta logs
id: 56aae066-d619-477c-93e3-3fb83b2d23c3
known_false_positives: ''
name: Investigate Okta Activity by IP Address
references: []
id: 56aae066-d619-477c-93e3-3fb83b2d23c3
version: 1
date: '2020-04-02'
author: Rico Valdez, Splunk
type: Investigation
datamodel: []
description: This search returns all okta events from a specific IP address.
search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country,
client.geographicalContext.state as state, client.geographicalContext.city as city
| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
how_to_implement: You must be ingesting Okta logs
known_false_positives: ''
references: []
tags:
analytic_story:
- Suspicious Okta Activity
@@ -23,5 +25,3 @@ tags:
- src_ip
- user
security_domain: network
type: Investigation
version: 1
detections/cloud/investigate_user_activities_in_okta.yml
+10 -10
View File
@@ -1,15 +1,17 @@
author: Rico Valdez, Splunk
datamodel: []
date: '2020-04-02'
description: This search returns all okta events by a specific user
how_to_implement: You must be ingesting Okta logs
id: 24ff145d-4d16-420a-b047-480f2a51c403
known_false_positives: ''
name: Investigate User Activities In Okta
references: []
id: 24ff145d-4d16-420a-b047-480f2a51c403
version: 1
date: '2020-04-02'
author: Rico Valdez, Splunk
type: Investigation
datamodel: []
description: This search returns all okta events by a specific user
search: '`okta` user=$user$ | rename client.geographicalContext.country as country,
client.geographicalContext.state as state, client.geographicalContext.city as city
| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
how_to_implement: You must be ingesting Okta logs
known_false_positives: ''
references: []
tags:
analytic_story:
- Suspicious Okta Activity
@@ -22,5 +24,3 @@ tags:
- src_ip
- user
security_domain: network
type: Investigation
version: 1
detections/cloud/kubernetes_nginx_ingress_lfi.yml
+1 -1
View File
@@ -44,9 +44,9 @@ tags:
- DE.CM
observable:
- name: src_ip
type: IP Address
role:
- Attacker
type: IP Address
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/kubernetes_nginx_ingress_rfi.yml
+1 -1
View File
@@ -43,9 +43,9 @@ tags:
- DE.CM
observable:
- name: src_ip
type: IP Address
role:
- Attacker
type: IP Address
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/kubernetes_scanner_image_pulling.yml
+10 -10
View File
@@ -1,20 +1,22 @@
author: Patrick Bareiss, Splunk
datamodel: []
name: Kubernetes Scanner Image Pulling
id: 4890cd6b-0112-4974-a272-c5c153aee551
version: 1
date: '2021-08-24'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
to detect Kubernetes Security Scanner.
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
id: 4890cd6b-0112-4974-a272-c5c153aee551
known_false_positives: unknown
name: Kubernetes Scanner Image Pulling
references:
- https://github.com/splunk/splunk-connect-for-kubernetes
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
| rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
| eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time)
as lastTime count by host, name, namespace, kind, reason, message, phase, severity
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
references:
- https://github.com/splunk/splunk-connect-for-kubernetes
tags:
analytic_story:
- Dev Sec Ops
@@ -48,5 +50,3 @@ tags:
required_fields: []
risk_score: 81
security_domain: network
type: TTP
version: 1
detections/cloud/o365_add_app_role_assignment_grant_user.yml
+14 -14
View File
@@ -1,23 +1,25 @@
author: Rod Soto, Splunk
datamodel: []
name: O365 Add App Role Assignment Grant User
id: b2c81cc6-6040-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel: []
description: This search detects the creation of a new Federation setting by alerting
about an specific event related to its creation.
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: b2c81cc6-6040-11eb-ae93-0242ac130002
known_false_positives: The creation of a new Federation is not necessarily malicious,
however this events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
name: O365 Add App Role Assignment Grant User
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app
role assignment grant to user." | stats count min(_time) as firstTime max(_time)
as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by
ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `o365_add_app_role_assignment_grant_user_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: The creation of a new Federation is not necessarily malicious,
however this events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
tags:
analytic_story:
- Office 365 Detections
@@ -67,5 +69,3 @@ tags:
- dest
risk_score: 18
security_domain: threat
type: TTP
version: 1
detections/cloud/o365_added_service_principal.yml
+16 -16
View File
@@ -1,26 +1,28 @@
author: Rod Soto, Splunk
datamodel: []
name: O365 Added Service Principal
id: 1668812a-6047-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel: []
description: This search detects the creation of a new Federation setting by alerting
about an specific event related to its creation.
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: 1668812a-6047-11eb-ae93-0242ac130002
known_false_positives: The creation of a new Federation is not necessarily malicious,
however these events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
name: O365 Added Service Principal
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service
principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `o365_added_service_principal_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: The creation of a new Federation is not necessarily malicious,
however these events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
tags:
analytic_story:
- Office 365 Detections
@@ -64,5 +66,3 @@ tags:
- signature
risk_score: 42
security_domain: threat
type: TTP
version: 1
detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+13 -13
View File
@@ -1,18 +1,13 @@
author: Bhavin Patel, Splunk
datamodel: []
name: O365 Bypass MFA via Trusted IP
id: c783dd98-c703-4252-9e8a-f19d9f66949e
version: 2
date: '2021-07-19'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
description: This search detects newly added IP addresses/CIDR blocks to the list
of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
to use this technique so that they can bypass the MFA system.
how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: c783dd98-c703-4252-9e8a-f19d9f66949e
known_false_positives: Unless it is a special case, it is uncommon to continually
update Trusted IPs to MFA configuration.
name: O365 Bypass MFA via Trusted IP
references:
- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
- https://attack.mitre.org/techniques/T1562/007/
search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
@@ -22,6 +17,13 @@ search: '`o365_management_activity` signature="Set Company Information." Modifie
as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account
status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`o365_bypass_mfa_via_trusted_ip_filter`'
how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: Unless it is a special case, it is uncommon to continually
update Trusted IPs to MFA configuration.
references:
- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
- https://attack.mitre.org/techniques/T1562/007/
tags:
analytic_story:
- Office 365 Detections
@@ -68,5 +70,3 @@ tags:
- vendor_account
risk_score: 42
security_domain: threat
type: TTP
version: 2
detections/cloud/o365_disable_mfa.yml
+2 -2
View File
@@ -40,13 +40,13 @@ tags:
- T1556
observable:
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/o365_excessive_authentication_failures_alert.yml
+2 -2
View File
@@ -41,13 +41,13 @@ tags:
- T1110
observable:
- name: src_ip
type: IP Address
role:
- Attacker
type: IP Address
- name: user
type: User
role:
- Victim
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/o365_excessive_sso_logon_errors.yml
+2 -2
View File
@@ -42,13 +42,13 @@ tags:
- T1556
observable:
- name: ActorIpAddress
type: IP Address
role:
- Attacker
type: IP Address
- name: UserId
type: User
role:
- Victim
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/o365_new_federated_domain_added.yml
+11 -11
View File
@@ -1,25 +1,27 @@
author: Rod Soto, Splunk
datamodel: []
name: O365 New Federated Domain Added
id: e155876a-6048-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel: []
description: This search detects the addition of a new Federated domain.
search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `o365_new_federated_domain_added_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity.
id: e155876a-6048-11eb-ae93-0242ac130002
known_false_positives: The creation of a new Federated domain is not necessarily malicious,
however these events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a similar or different cloud provider.
name: O365 New Federated Domain Added
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
- https://o365blog.com/post/aadbackdoor/
search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `o365_new_federated_domain_added_filter`'
tags:
analytic_story:
- Office 365 Detections
@@ -68,5 +70,3 @@ tags:
- _time
risk_score: 64
security_domain: threat
type: TTP
version: 1
detections/cloud/o365_pst_export_alert.yml
+1 -1
View File
@@ -41,9 +41,9 @@ tags:
- T1114
observable:
- name: Source
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/o365_suspicious_admin_email_forwarding.yml
+1 -1
View File
@@ -45,9 +45,9 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/o365_suspicious_rights_delegation.yml
+1 -1
View File
@@ -44,9 +44,9 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/o365_suspicious_user_email_forwarding.yml
+2 -2
View File
@@ -45,13 +45,13 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
- name: ForwardingSmtpAddress
type: Email Address
role:
- Other
type: Email Address
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
detections/cloud/previously_seen_aws_cross_account_activity.yml
+12 -12
View File
@@ -1,22 +1,24 @@
author: David Dorsey, Splunk
datamodel: []
name: Previously Seen AWS Cross Account Activity
id: 1cc22b09-c867-416e-a511-cb36ac44aee2
version: 1
date: '2018-06-04'
author: David Dorsey, Splunk
type: Baseline
datamodel: []
description: This search looks for **AssumeRole** events where the requesting account
differs from the requested account, then writes these relationships to a lookup
file.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
a lookup file created by this support search.
id: 1cc22b09-c867-416e-a511-cb36ac44aee2
known_false_positives: none
name: Previously Seen AWS Cross Account Activity
references: []
search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
| spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
| where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime
latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup
previously_seen_aws_cross_account_activity | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
a lookup file created by this support search.
known_false_positives: none
references: []
tags:
analytic_story:
- AWS Cross Account Activity
@@ -32,5 +34,3 @@ tags:
- _time
- eventName
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_aws_cross_account_activity_initial.yml
+12 -12
View File
@@ -1,19 +1,14 @@
name: Previously Seen AWS Cross Account Activity - Initial
id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
version: 1
date: '2020-08-15'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Authentication
date: '2020-08-15'
description: This search looks for **AssumeRole** events where the requesting account
differs from the requested account, then writes these relationships to a lookup
file.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later)and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
support search.
id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
known_false_positives: none
name: Previously Seen AWS Cross Account Activity - Initial
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -21,6 +16,13 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
!= dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId
| table requestingAccountId requestedAccountId firstTime lastTime | outputlookup
previously_seen_aws_cross_account_activity'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later)and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
support search.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -41,5 +43,3 @@ tags:
- Authentication.Authentication.vendor_account
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_aws_cross_account_activity_update.yml
+12 -12
View File
@@ -1,19 +1,14 @@
name: Previously Seen AWS Cross Account Activity - Update
id: dd6fb3a9-4906-48cb-8626-c88a25a056c3
version: 1
date: '2020-08-15'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Authentication
date: '2020-08-15'
description: This search looks for **AssumeRole** events where the requesting account
differs from the requested account, then writes these relationships to a lookup
file.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
support search.
id: dd6fb3a9-4906-48cb-8626-c88a25a056c3
known_false_positives: none
name: Previously Seen AWS Cross Account Activity - Update
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -22,6 +17,13 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
| inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime)
as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId
| outputlookup previously_seen_aws_cross_account_activity'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
support search.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -42,5 +44,3 @@ tags:
- Authentication.Authentication.vendor_account
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml
+9 -9
View File
@@ -1,22 +1,24 @@
name: Previously Seen Cloud API Calls Per User Role - Initial
id: 69d75f4b-b794-4a66-a777-730357b886b4
version: 1
date: '2020-09-03'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-09-03'
description: This search builds a table of the first and last times seen for every
user role and command combination. This is broadly defined as any event that runs
or creates something. This table is then cached.
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
id: 69d75f4b-b794-4a66-a777-730357b886b4
known_false_positives: none
name: Previously Seen Cloud API Calls Per User Role - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success
by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -36,5 +38,3 @@ tags:
- Change.All_Changes.user_type
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml
+9 -9
View File
@@ -1,15 +1,13 @@
name: Previously Seen Cloud API Calls Per User Role - Update
id: c4b760a0-6a97-47e9-b089-8ae9e57f210e
version: 1
date: '2020-09-03'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-09-03'
description: This search updates the table of the first and last times seen for every
user role and command combination.
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
id: c4b760a0-6a97-47e9-b089-8ae9e57f210e
known_false_positives: none
name: Previously Seen Cloud API Calls Per User Role - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success
by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
@@ -19,6 +17,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -38,5 +40,3 @@ tags:
- Change.All_Changes.user_type
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
+9 -9
View File
@@ -1,19 +1,21 @@
name: Previously Seen Cloud Compute Creations By User - Initial
id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
version: 1
date: '2020-08-15'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-15'
description: This search builds a table of previously seen users that have launched
a cloud compute instance.
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the proper TAs installed.
id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
known_false_positives: none
name: Previously Seen Cloud Compute Creations By User - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created AND All_Changes.object_category=instance
by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user
| stats count'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the proper TAs installed.
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -32,5 +34,3 @@ tags:
- Change.All_Changes.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
+9 -9
View File
@@ -1,15 +1,13 @@
name: Previously Seen Cloud Compute Creations By User - Update
id: 6bf75d69-7766-47bc-8097-e41696807a6f
version: 1
date: '2020-08-15'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-15'
description: This search builds a table of previously seen users that have launched
a cloud compute instance.
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the proper TAs installed.
id: 6bf75d69-7766-47bc-8097-e41696807a6f
known_false_positives: none
name: Previously Seen Cloud Compute Creations By User - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created AND All_Changes.object_category=instance
by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t
@@ -17,6 +15,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(),
"-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data
= if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the proper TAs installed.
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -35,5 +37,3 @@ tags:
- Change.All_Changes.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_compute_images_initial.yml
+9 -9
View File
@@ -1,21 +1,23 @@
name: Previously Seen Cloud Compute Images - Initial
id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
version: 1
date: '2020-10-08'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-10-08'
description: This search builds a table of previously seen images used to launch cloud
compute instances
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the latest Change Datamodel accelerated
id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
known_false_positives: none
name: Previously Seen Cloud Compute Images - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id
| `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
| where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime
| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
| outputlookup previously_seen_cloud_compute_images'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the latest Change Datamodel accelerated
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -32,5 +34,3 @@ tags:
- Change.All_Changes.action
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_compute_images_update.yml
+8 -8
View File
@@ -1,14 +1,13 @@
name: Previously Seen Cloud Compute Images - Update
id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184
version: 1
date: '2020-08-12'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-12'
description: This search builds a table of previously seen images used to launch cloud
compute instances
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184
known_false_positives: none
name: Previously Seen Cloud Compute Images - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id
| `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -17,6 +16,9 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`)
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -33,5 +35,3 @@ tags:
- Change.All_Changes.action
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml
+9 -9
View File
@@ -1,20 +1,22 @@
name: Previously Seen Cloud Compute Instance Types - Initial
id: 3c78025c-1ffe-4976-a640-75ef604842be
version: 1
date: 2020-9-03
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: 2020-9-03
description: This search builds a table of previously seen cloud compute instance
types
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
id: 3c78025c-1ffe-4976-a640-75ef604842be
known_false_positives: none
name: Previously Seen Cloud Compute Instance Types - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type
| `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type !=
"unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data
= if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -31,5 +33,3 @@ tags:
- Change.All_Changes.action
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_compute_instance_types_update.yml
+8 -8
View File
@@ -1,14 +1,13 @@
name: Previously Seen Cloud Compute Instance Types - Update
id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c
version: 1
date: 2020-9-03
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: 2020-9-03
description: This search builds a table of previously seen cloud compute instance
types
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c
known_false_positives: none
name: Previously Seen Cloud Compute Instance Types - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type
| `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type !=
@@ -17,6 +16,9 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`)
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -33,5 +35,3 @@ tags:
- Change.All_Changes.action
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
+9 -9
View File
@@ -1,20 +1,22 @@
name: Previously Seen Cloud Instance Modifications By User - Initial
id: f36dc403-739d-42f3-83a3-49237d8654c5
version: 1
date: '2020-07-29'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Change
date: '2020-07-29'
description: This search builds a table of previously seen users that have modified
a cloud instance.
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the latest Change Datamodel accelerated.
id: f36dc403-739d-42f3-83a3-49237d8654c5
known_false_positives: none
name: Previously Seen Cloud Instance Modifications By User - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2
c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats
min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <=
relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the latest Change Datamodel accelerated.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -33,5 +35,3 @@ tags:
- Change.All_Changes.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
+10 -10
View File
@@ -1,16 +1,13 @@
name: Previously Seen Cloud Instance Modifications By User - Update
id: 534b7d30-7b0c-4510-8f55-65439850d58d
version: 1
date: '2020-07-29'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Change
date: '2020-07-29'
description: This search updates a table of previously seen Cloud Instance modifications
that have been made by a user
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
id: 534b7d30-7b0c-4510-8f55-65439850d58d
known_false_positives: none
name: Previously Seen Cloud Instance Modifications By User - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2
All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
@@ -19,6 +16,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`)
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -38,5 +40,3 @@ tags:
- Change.All_Changes.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
+9 -9
View File
@@ -1,17 +1,15 @@
name: Previously Seen Cloud Provisioning Activity Sources - Initial
id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7
version: 1
date: '2020-08-19'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-19'
description: This search builds a table of the first and last times seen for every
IP address (along with its physical location) previously associated with cloud-provisioning
activity. This is broadly defined as any event that runs or creates something. This
table is then cached.
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7
known_false_positives: none
name: Previously Seen Cloud Provisioning Activity Sources - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")`
@@ -19,6 +17,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
| table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup
previously_seen_cloud_provisioning_activity_sources'
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -40,5 +42,3 @@ tags:
- Change.All_Changes.status
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
+9 -9
View File
@@ -1,19 +1,17 @@
name: Previously Seen Cloud Provisioning Activity Sources - Update
id: 9830abb9-be80-4563-b232-09bf1f628cf3
version: 1
date: '2020-08-20'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-08-20'
description: This returns the first and last times seen for every IP address (along
with its physical location) previously associated with cloud-provisioning activity
within the last day. Cloud provisioning is broadly defined as any event that runs
or creates something. It then updates this information with historical data and
filters out locations that have not been seen within the specified time window.
This updated table is then cached.
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
id: 9830abb9-be80-4563-b232-09bf1f628cf3
known_false_positives: none
name: Previously Seen Cloud Provisioning Activity Sources - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")`
@@ -24,6 +22,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen,
lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources'
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
provider.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -45,5 +47,3 @@ tags:
- Change.All_Changes.status
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_regions_initial.yml
+9 -9
View File
@@ -1,22 +1,24 @@
name: Previously Seen Cloud Regions - Initial
id: b5e232db-dec6-4db8-aaa1-dd5474521e40
version: 1
date: '2020-09-02'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-09-02'
description: This search looks for cloud compute events where a compute instance is
started and creates a baseline of most recent time, `lastTime` and the first time
`firstTime` we've seen this region in our dataset grouped by the region for the
last 30 days
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
id: b5e232db-dec6-4db8-aaa1-dd5474521e40
known_false_positives: none
name: Previously Seen Cloud Regions - Initial
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region
| `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime
| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0)
| outputlookup previously_seen_cloud_regions'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -34,5 +36,3 @@ tags:
- Change.All_Changes.vendor_region
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_cloud_regions_update.yml
+9 -9
View File
@@ -1,17 +1,15 @@
name: Previously Seen Cloud Regions - Update
id: 512f928a-a461-41b4-8984-db4dd2c472e4
version: 1
date: '2020-09-02'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Change
date: '2020-09-02'
description: This search looks for cloud compute events where a compute instance is
started and creates a baseline of most recent time, `lastTime` and the first time
`firstTime` we've seen this region in our dataset grouped by the region for the
last 30 days
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
id: 512f928a-a461-41b4-8984-db4dd2c472e4
known_false_positives: none
name: Previously Seen Cloud Regions - Update
references: []
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region
| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions
@@ -20,6 +18,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
| eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
<= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions
| stats count'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
known_false_positives: none
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -37,5 +39,3 @@ tags:
- Change.All_Changes.vendor_region
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_ec2_modifications_by_user.yml
+11 -11
View File
@@ -1,18 +1,20 @@
author: David Dorsey, Splunk
datamodel: []
name: Previously Seen EC2 Modifications By User
id: 4d69091b-d975-4267-85df-888bd41034eb
version: 1
date: '2018-04-05'
author: David Dorsey, Splunk
type: Baseline
datamodel: []
description: This search builds a table of previously seen ARNs that have launched
a EC2 instance.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
id: 4d69091b-d975-4267-85df-888bd41034eb
known_false_positives: none
name: Previously Seen EC2 Modifications By User
references: []
search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn
userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime
by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
known_false_positives: none
references: []
tags:
analytic_story:
- Unusual AWS EC2 Modifications
@@ -28,5 +30,3 @@ tags:
- _time
- errorCode
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
+12 -12
View File
@@ -1,25 +1,27 @@
name: Previously Seen Users in CloudTrail - Initial
id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
version: 1
date: '2020-05-28'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Authentication
date: '2020-05-28'
description: This search looks for CloudTrail events where a user logs into the console,
then creates a baseline of the latest and earliest times, City, Region, and Country
we have encountered this user in our dataset, grouped by username, within the last
30 days.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_users_console_logins`, which is a lookup file created by this
support search.
id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
known_false_positives: none
name: Previously Seen Users in CloudTrail - Initial
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | rename Authentication.user as user Authentication.src
as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins
| stats count'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_users_console_logins`, which is a lookup file created by this
support search.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -41,5 +43,3 @@ tags:
- Authentication.Authentication.user
- _time
security_domain: network
type: Baseline
version: 1
detections/cloud/previously_seen_users_in_cloudtrail_update.yml
+12 -12
View File
@@ -1,25 +1,27 @@
name: Previously Seen Users In CloudTrail - Update
id: 66ff71c2-7e01-47dd-a041-906688c9d322
version: 1
date: '2020-05-28'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Authentication
date: '2020-05-28'
description: This search looks for CloudTrail events where a user logs into the console,
then updates the baseline of the latest and earliest times, City, Region, and Country
we have encountered this user in our dataset, grouped by user, within the last hour.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_users_console_logins`, which is a lookup file created by this
support search.
id: 66ff71c2-7e01-47dd-a041-906688c9d322
known_false_positives: none
name: Previously Seen Users In CloudTrail - Update
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | rename Authentication.user as user Authentication.src
as src | table user src City Region Country firstTime lastTime | inputlookup append=t
previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime)
as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Validate the user name entries
in `previously_seen_users_console_logins`, which is a lookup file created by this
support search.
known_false_positives: none
references: []
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -41,5 +43,3 @@ tags:
- Authentication.Authentication.user
- _time
security_domain: network
type: Baseline
version: 1
detections/endpoint/7zip_commandline_to_smb_share_path.yml
+12 -12
View File
@@ -1,21 +1,16 @@
name: 7zip CommandLine To SMB Share Path
id: 01d29b48-ff6f-11eb-b81e-acde48001122
version: 1
date: '2021-08-17'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
date: '2021-08-17'
description: This search is to detect a suspicious 7z process with commandline pointing
to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
to archive a sensitive files and place it in network share tmp folder. This search
is a good hunting query that may give analyst a hint why specific user try to archive
a file pointing to SMB user which is un usual.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
id: 01d29b48-ff6f-11eb-b81e-acde48001122
known_false_positives: unknown
name: 7zip CommandLine To SMB Share Path
references:
- https://threadreaderapp.com/thread/1423361119926816776.html
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe"
OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe"
@@ -25,6 +20,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process_id Processes.process_id Processes.dest Processes.user
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `7zip_commandline_to_smb_share_path_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
known_false_positives: unknown
references:
- https://threadreaderapp.com/thread/1423361119926816776.html
tags:
analytic_story:
- Ransomware
@@ -69,5 +71,3 @@ tags:
- _time
risk_score: 25
security_domain: endpoint
type: Hunting
version: 1
detections/endpoint/baseline_of_command_line_length___mltk.yml
+10 -10
View File
@@ -1,12 +1,21 @@
name: Baseline of Command Line Length - MLTK
id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
version: 1
date: '2019-05-08'
author: Rico Valdez, Splunk
type: Baseline
datamodel:
- Endpoint
date: '2019-05-08'
description: This search is used to build a Machine Learning Toolkit (MLTK) model
to characterize the length of the command lines observed for each user in the environment.
By default, the search uses the last 30 days of data to build the model. The model
created by this search is then used in the corresponding detection search, which
identifies outliers in the length of the command line.
search: '| tstats `security_content_summariesonly` count min(_time) as start_time
max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
how_to_implement: You must be ingesting endpoint data and populating the Endpoint
data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
>= 4.2 installed, along with any required dependencies. Depending on the number
@@ -17,15 +26,8 @@ how_to_implement: You must be ingesting endpoint data and populating the Endpoin
a longer period of time, which may give you better results. You may also want to
periodically re-run this search to rebuild the model with the latest data. More
information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
known_false_positives: none
name: Baseline of Command Line Length - MLTK
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as start_time
max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
tags:
analytic_story:
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
@@ -49,5 +51,3 @@ tags:
- Endpoint.Processes.user
- _time
security_domain: endpoint
type: Baseline
version: 1
detections/endpoint/batch_file_write_to_system32.yml
+18 -18
View File
@@ -1,24 +1,13 @@
name: Batch File Write to System32
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
version: 2
date: '2021-09-16'
author: Michael Haag, Rico Valdez, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-16'
description: The search looks for a batch file (.bat) written to the Windows system
directory tree.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
known_false_positives: It is possible for this search to generate a notable event
for a batch file write to a path that includes the string "system32", but is not
the actual Windows system directory. As such, you should confirm the path of the
batch file identified by the search. In addition, a false positive may be generated
by an administrator copying a legitimate batch file in this directory tree. You
should confirm that the activity is legitimate and modify the search to add exclusions,
as necessary.
name: Batch File Write to System32
references: []
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=* by _time span=1h Processes.process_id Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -29,6 +18,19 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
| fields _time dest file_create_time file_name file_path process_name process_path
process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
process_name | `batch_file_write_to_system32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: It is possible for this search to generate a notable event
for a batch file write to a path that includes the string "system32", but is not
the actual Windows system directory. As such, you should confirm the path of the
batch file identified by the search. In addition, a false positive may be generated
by an administrator copying a legitimate batch file in this directory tree. You
should confirm that the activity is legitimate and modify the search to add exclusions,
as necessary.
references: []
tags:
analytic_story:
- SamSam Ransomware
@@ -81,5 +83,3 @@ tags:
- _time
risk_score: 63
security_domain: endpoint
type: TTP
version: 2
detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+12 -12
View File
@@ -1,28 +1,30 @@
name: Bcdedit Command Back To Normal Mode Boot
id: dc7a8004-0f18-11ec-8c54-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-06'
description: This search is to detect a suspicious bcdedit commandline to configure
the host from safe mode back to normal boot configuration. This technique was seen
in blackMatter ransomware where it force the compromised host to boot in safe mode
to continue its encryption and bring back to normal boot using bcdedit deletevalue
command. This TTP can be a good alert for host that booted from safe mode forcefully
since it need to modify the boot configuration to bring it back to normal.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
id: dc7a8004-0f18-11ec-8c54-acde48001122
known_false_positives: unknown
name: Bcdedit Command Back To Normal Mode Boot
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="bcdedit.exe"
Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*"
by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -62,5 +64,3 @@ tags:
- _time
risk_score: 35
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/bcdedit_failure_recovery_modification.yml
+11 -11
View File
@@ -1,24 +1,26 @@
name: BCDEdit Failure Recovery Modification
id: 809b31d2-5462-11eb-ae93-0242ac130002
version: 1
date: '2020-12-21'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
date: '2020-12-21'
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. Tune based on parent process names.
id: 809b31d2-5462-11eb-ae93-0242ac130002
known_false_positives: Administrators may modify the boot configuration.
name: BCDEdit Failure Recovery Modification
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="bcdedit.exe"
Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name
Processes.process Processes.parent_process_name Processes.dest Processes.user |
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `bcdedit_failure_recovery_modification_filter`'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. Tune based on parent process names.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
tags:
analytic_story:
- Ryuk Ransomware
@@ -73,5 +75,3 @@ tags:
- _time
risk_score: 80
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/bits_job_persistence.yml
+18 -18
View File
@@ -1,7 +1,11 @@
name: BITS Job Persistence
id: e97a5ffe-90bf-11eb-928a-acde48001122
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-16'
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
The query identifies the parameters used to create, resume or add a file to a BITS
@@ -9,21 +13,6 @@ description: The following query identifies Microsoft Background Intelligent Tra
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: e97a5ffe-90bf-11eb-928a-acde48001122
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
name: BITS Job Persistence
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
@@ -31,6 +20,19 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
tags:
analytic_story:
- BITS Jobs
@@ -81,5 +83,3 @@ tags:
- _time
risk_score: 56
security_domain: endpoint
type: TTP
version: 2
detections/endpoint/bitsadmin_download_file.yml
+17 -17
View File
@@ -1,7 +1,11 @@
name: BITSAdmin Download File
id: 80630ff4-8e4c-11eb-aab5-acde48001122
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-16'
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
object. In addition, look for `download` or `upload` on the command-line, the switches
@@ -14,26 +18,24 @@ description: The following query identifies Microsoft Background Intelligent Tra
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 80630ff4-8e4c-11eb-aab5-acde48001122
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
name: BITSAdmin Download File
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer*
by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `bitsadmin_download_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
tags:
analytic_story:
- Ingress Tool Transfer
@@ -87,5 +89,3 @@ tags:
- _time
risk_score: 49
security_domain: endpoint
type: TTP
version: 2
detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+16 -16
View File
@@ -1,7 +1,11 @@
name: CertUtil Download With URLCache and Split Arguments
id: 415b4306-8bfb-11eb-85c4-acde48001122
version: 2
date: '2021-03-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-03-23'
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -9,25 +13,23 @@ description: Certutil.exe may download a file from a remote destination using `-
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 415b4306-8bfb-11eb-85c4-acde48001122
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
name: CertUtil Download With URLCache and Split Arguments
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache*
Processes.process=*split* by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.original_file_name
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
tags:
analytic_story:
- Ingress Tool Transfer
@@ -79,5 +81,3 @@ tags:
- _time
risk_score: 90
security_domain: endpoint
type: TTP
version: 2
detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+17 -17
View File
@@ -1,7 +1,11 @@
name: CertUtil Download With VerifyCtl and Split Arguments
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
version: 2
date: '2021-03-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-03-23'
description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -9,26 +13,24 @@ description: 'Certutil.exe may download a file from a remote destination using `
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
name: CertUtil Download With VerifyCtl and Split Arguments
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl*
Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
tags:
analytic_story:
- Ingress Tool Transfer
@@ -80,5 +82,3 @@ tags:
- _time
risk_score: 90
security_domain: endpoint
type: TTP
version: 2
detections/endpoint/certutil_exe_certificate_extraction.yml
+12 -12
View File
@@ -1,24 +1,26 @@
name: Certutil exe certificate extraction
id: 337a46be-600f-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-01-26'
description: This search looks for arguments to certutil.exe indicating the manipulation
or extraction of Certificate. This certificate can then be used to sign new authentication
tokens specially inside Federated environments such as Windows ADFS.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 337a46be-600f-11eb-ae93-0242ac130002
known_false_positives: Unless there are specific use cases, manipulating or exporting
certificates using certutil is uncommon. Extraction of certificate has been observed
during attacks such as Golden SAML and other campaigns targeting Federated services.
name: Certutil exe certificate extraction
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="certutil.exe"
Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Unless there are specific use cases, manipulating or exporting
certificates using certutil is uncommon. Extraction of certificate has been observed
during attacks such as Golden SAML and other campaigns targeting Federated services.
references: []
tags:
analytic_story:
- Windows Persistence Techniques
@@ -68,5 +70,3 @@ tags:
- _time
risk_score: 63
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/certutil_with_decode_argument.yml
+18 -18
View File
@@ -1,7 +1,11 @@
name: CertUtil With Decode Argument
id: bfe94226-8c10-11eb-a4b3-acde48001122
version: 2
date: '2021-03-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-03-23'
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
@@ -10,26 +14,24 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: bfe94226-8c10-11eb-a4b3-acde48001122
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
name: CertUtil With Decode Argument
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
tags:
analytic_story:
- Deobfuscate-Decode Files or Information
@@ -79,5 +81,3 @@ tags:
- _time
risk_score: 40
security_domain: endpoint
type: TTP
version: 2
detections/endpoint/change_default_file_association.yml
+14 -14
View File
@@ -1,29 +1,31 @@
name: Change Default File Association
id: 462d17d8-1f71-11ec-ad07-acde48001122
version: 1
date: '2021-09-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-27'
description: This analytic is developed to detect suspicious registry modification
to change the default file association of windows to malicious payload. This techninique
was seen in some APT where it modify the default process to run file association,
like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
payload that will load malicious command to the compromised host.
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
id: 462d17d8-1f71-11ec-ad07-acde48001122
known_false_positives: unknown
name: Change Default File Association
references:
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user
Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
| `change_default_file_association_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
known_false_positives: unknown
references:
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
tags:
analytic_story:
- Windows Persistence Techniques
@@ -64,5 +66,3 @@ tags:
- _time
risk_score: 80
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/change_to_safe_mode_with_network_config.yml
+12 -12
View File
@@ -1,28 +1,30 @@
name: Change To Safe Mode With Network Config
id: 81f1dce0-0f18-11ec-a5d7-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-06'
description: This search is to detect a suspicious bcdedit commandline to configure
the host to boot in safe mode with network config. This technique was seen in blackMatter
ransomware where it force the compromised host to boot in safe mode to continue
its encryption and bring back to normal boot using bcdedit deletevalue command.
This TTP can be a good alert for host that booted from safe mode forcefully since
it need to modify the boot configuration to bring it back to normal.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
id: 81f1dce0-0f18-11ec-a5d7-acde48001122
known_false_positives: unknown
name: Change To Safe Mode With Network Config
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="bcdedit.exe"
Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*"
Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -61,5 +63,3 @@ tags:
- _time
risk_score: 25
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/chcp_command_execution.yml
+14 -14
View File
@@ -1,27 +1,29 @@
name: CHCP Command Execution
id: 21d236ec-eec1-11eb-b23e-acde48001122
version: 1
date: '2021-07-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-07-27'
description: This search is to detect execution of chcp.exe application. this utility
is used to change the active code page of the console. This technique was seen in
icedid malware to know the locale region/language/country of the compromise host.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
id: 21d236ec-eec1-11eb-b23e-acde48001122
known_false_positives: other tools or script may used this to change code page to
UTF-* or others
name: CHCP Command Execution
references:
- https://ss64.com/nt/chcp.html
- https://twitter.com/tccontre18/status/1419941156633329665?s=20
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="chcp.com"
Processes.parent_process_name="cmd.exe" Processes.parent_process="*/c*" by Processes.process_name
Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
known_false_positives: other tools or script may used this to change code page to
UTF-* or others
references:
- https://ss64.com/nt/chcp.html
- https://twitter.com/tccontre18/status/1419941156633329665?s=20
tags:
analytic_story:
- IcedID
@@ -72,5 +74,3 @@ tags:
- user
risk_score: 9
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/check_elevated_cmd_using_whoami.yml
+11 -11
View File
@@ -1,7 +1,11 @@
name: Check Elevated CMD using whoami
id: a9079b18-1633-11ec-859c-acde48001122
version: 1
date: '2021-09-15'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-09-15'
description: This search is to detect a suspicious whoami execution to check if the
cmd or shell instance process is with elevated privileges. This technique was seen
in FIN7 js implant where it execute this as part of its data collection to the infected
@@ -9,20 +13,18 @@ description: This search is to detect a suspicious whoami execution to check if
really a good alert for known attacker that recon on the targetted host. This command
is not so commonly executed by a normal user or even an admin to check if a process
is elevated.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
id: a9079b18-1633-11ec-859c-acde48001122
known_false_positives: unknown
name: Check Elevated CMD using whoami
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process = "*whoami*"
Processes.process = "*/group*" Processes.process = "* find *" Processes.process
= "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references: []
tags:
analytic_story:
- FIN7
@@ -63,5 +65,3 @@ tags:
- _time
risk_score: 56
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+12 -12
View File
@@ -1,25 +1,27 @@
name: Clear Unallocated Sector Using Cipher App
id: cd80a6ac-c9d9-11eb-8839-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-06-10'
description: this search is to detect execution of `cipher.exe` to clear the unallocated
sectors of a specific disk. This technique was seen in some ransomware to make it
impossible to forensically recover deleted files.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: cd80a6ac-c9d9-11eb-8839-acde48001122
known_false_positives: administrator may execute this app to manage disk
name: Clear Unallocated Sector Using Cipher App
references:
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe"
Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process
Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: administrator may execute this app to manage disk
references:
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
tags:
analytic_story:
- Ransomware
@@ -72,5 +74,3 @@ tags:
- _time
risk_score: 90
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/clop_common_exec_parameter.yml
+12 -12
View File
@@ -1,7 +1,11 @@
name: Clop Common Exec Parameter
id: 5a8a2a72-8322-11eb-9ee9-acde48001122
version: 1
date: '2021-03-17'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
date: '2021-03-17'
description: The following analytics are designed to identifies some CLOP ransomware
variant that using arguments to execute its main code or feature of its code. In
this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files
@@ -9,15 +13,6 @@ description: The following analytics are designed to identifies some CLOP ransom
pipe or file start encrypting files within the infected local machines. This technique
can be also identified as an anti-sandbox technique to make its code non-responsive
since it is waiting for some parameter to execute properly.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 5a8a2a72-8322-11eb-9ee9-acde48001122
known_false_positives: Operators can execute third party tools using these parameters.
name: Clop Common Exec Parameter
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
values(Processes.parent_process_name) as parent_process values(Processes.process_name)
count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -25,6 +20,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
= "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Operators can execute third party tools using these parameters.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
analytic_story:
- Clop Ransomware
@@ -76,5 +78,3 @@ tags:
- _time
risk_score: 100
security_domain: endpoint
type: TTP
version: 1

Some files were not shown because too many files have changed in this diff Show More