remove root aws detections and update aws detection

detections/cloud/aws_iam_assume_role_policy_brute_force.yml

@@ -6,8 +6,8 @@ author: Michael Haag, Splunk
 type: batch
 datamodel: []
 description: The following detection identifies any malformed policy document exceptions
-  with a status of `failure`. Meaning, when an adversary is attempting to identify
-  a role name, multiple failures will occur.
+  with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`.  Meaning, when an adversary is attempting to identify
+  a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
 search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
   (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
   lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
@@ -22,6 +22,7 @@ known_false_positives: This detection will require tuning to provide high fideli
   or by groups of users.
 references:
 - https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
+- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
 - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
 tags:
   analytic_story:

detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml

@@ -1,38 +0,0 @@
-name: AWS IAM Detect Creation Usage of Access Keys with Root
-id: 42528528-9329-11eb-9fe1-acde48001122
-version: 1
-date: '2021-04-01'
-author: Michael Haag, Splunk
-type: batch
-datamodel: []
-description: THe following detection is aimed at detecting the Root user account creating keys. This is generally not an activity that would be performed after the Root account is locked down.
-search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userName=root (userAgent!=*.amazonaws.com)
-| stats count min(_time) as firstTime max(_time) as lastTime values(userName) by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)`
-| `aws_iam_detect_creation_usage_of_access_keys_with_root_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
-known_false_positives: Using the Root account for day to day activity is against best practices. Once Root is no longer used or needed for day to day operations, begin monitoring for usage.
-references:
-- https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html
-tags:
-  analytic_story: 
-  - AWS IAM Privilege Escalation
-  dataset: []
-  kill_chain_phases:
-  - Privilege Escalation
-  mitre_attack_id:
-  - T1078.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  - Splunk Security Analytics for AWS
-  required_fields:
-  - _time
-  - eventName
-  - userAgent
-  - errorCode
-  - eventSource
-  - user_arn
-  security_domain: access

detections/cloud/aws_iam_failure_group_deletion.yml

@@ -5,7 +5,7 @@ date: '2021-04-01'
 author: Michael Haag, Splunk
 type: batch
 datamodel: []
-description: This detection identifies the inverse of success. We want to identify
+description: This detection identifies failure attempts to delete groups. We want to identify
   when a group is attempting to be deleted, but either access is denied, there is
   a conflict or there is no group. This is indicative of administrators performing
   an action, but also could be suspicious behavior occurring. Review parallel IAM

tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml

@@ -1,13 +0,0 @@
-name: AWS IAM Detect Creation Usage of Access Keys with Root Unit Test
-tests:
-- name: AWS IAM Detect Creation Usage of Access Keys with Root
-  file: cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: aws_cloudtrail_events.json
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
-    sourcetype: aws:cloudtrail
-    source: aws_cloudtrail
-    update_timestamp: True