new detection and update 1

detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml

@@ -6,7 +6,7 @@ author: Bhavin Patel
 type: Anomaly
 datamodel: []
 description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
-search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
 known_false_positives: No known false postives for this detection. Please review this alert
 references:

detections/cloud/aws_password_policy_changes.yml

@@ -0,0 +1,66 @@
+name: AWS Password Policy Changes
+id: aee4a575-7064-4e60-b511-246f9baf9895
+version: 1
+date: '2023-01-26'
+author: Bhavin Patel, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your  AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. 
+search: '`cloudtrail` eventName=*PasswordPolicy  errorCode=success | stats count values(eventName) values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode  awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`  | `aws_password_policy_changes_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. 
+references:
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json
+  impact: 90
+  kill_chain_phases:
+  - Reconnaisance
+  message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$
+  mitre_attack_id:
+  - T1201
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.userName
+  - eventSource
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 72
+  security_domain: threat

tests/cloud/aws_password_policy_changes.test.yml

@@ -0,0 +1,13 @@
+name: AWS Password Policy Changes Unit Test
+tests:
+- name: AWS Password Policy Changes
+  file: cloud/aws_password_policy_changes.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true