From 2b40cfec8bf79c02cabc7fdc906ce1e831525e2a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 10:21:36 -0600 Subject: [PATCH] remove root aws detections and update aws detection --- ...aws_iam_assume_role_policy_brute_force.yml | 5 ++- ...reation_usage_of_access_keys_with_root.yml | 38 ------------------- .../cloud/aws_iam_failure_group_deletion.yml | 2 +- ...on_usage_of_access_keys_with_root.test.yml | 13 ------- 4 files changed, 4 insertions(+), 54 deletions(-) delete mode 100644 detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml delete mode 100644 tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index d48b6406bd..79a04c16f2 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -6,8 +6,8 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following detection identifies any malformed policy document exceptions - with a status of `failure`. Meaning, when an adversary is attempting to identify - a role name, multiple failures will occur. + with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify + a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing. search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource @@ -22,6 +22,7 @@ known_false_positives: This detection will require tuning to provide high fideli or by groups of users. references: - https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities +- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: analytic_story: diff --git a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml deleted file mode 100644 index e2a9cc748e..0000000000 --- a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: AWS IAM Detect Creation Usage of Access Keys with Root -id: 42528528-9329-11eb-9fe1-acde48001122 -version: 1 -date: '2021-04-01' -author: Michael Haag, Splunk -type: batch -datamodel: [] -description: THe following detection is aimed at detecting the Root user account creating keys. This is generally not an activity that would be performed after the Root account is locked down. -search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userName=root (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(userName) by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_detect_creation_usage_of_access_keys_with_root_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: Using the Root account for day to day activity is against best practices. Once Root is no longer used or needed for day to day operations, begin monitoring for usage. -references: -- https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html -tags: - analytic_story: - - AWS IAM Privilege Escalation - dataset: [] - kill_chain_phases: - - Privilege Escalation - mitre_attack_id: - - T1078.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Security Analytics for AWS - required_fields: - - _time - - eventName - - userAgent - - errorCode - - eventSource - - user_arn - security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index b550c785fd..e9838fea92 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -5,7 +5,7 @@ date: '2021-04-01' author: Michael Haag, Splunk type: batch datamodel: [] -description: This detection identifies the inverse of success. We want to identify +description: This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM diff --git a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml b/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml deleted file mode 100644 index 50fefd37b2..0000000000 --- a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: AWS IAM Detect Creation Usage of Access Keys with Root Unit Test -tests: -- name: AWS IAM Detect Creation Usage of Access Keys with Root - file: cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: aws_cloudtrail_events.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json - sourcetype: aws:cloudtrail - source: aws_cloudtrail - update_timestamp: True