From 2ff71df1b0fd97074dff3bec17269f847c4e2b26 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 26 Jan 2023 17:11:29 -0800 Subject: [PATCH] new detection and update 1 --- ..._users_failing_to_authenticate_from_ip.yml | 2 +- .../cloud/aws_password_policy_changes.yml | 66 +++++++++++++++++++ .../aws_password_policy_changes.test.yml | 13 ++++ 3 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/aws_password_policy_changes.yml create mode 100644 tests/cloud/aws_password_policy_changes.test.yml diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 2526a342ff..1a5c67bad6 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -6,7 +6,7 @@ author: Bhavin Patel type: Anomaly datamodel: [] description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives: No known false postives for this detection. Please review this alert references: diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml new file mode 100644 index 0000000000..a0a6a4610e --- /dev/null +++ b/detections/cloud/aws_password_policy_changes.yml @@ -0,0 +1,66 @@ +name: AWS Password Policy Changes +id: aee4a575-7064-4e60-b511-246f9baf9895 +version: 1 +date: '2023-01-26' +author: Bhavin Patel, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. +search: '`cloudtrail` eventName=*PasswordPolicy errorCode=success | stats count values(eventName) values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +references: +- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + - Compromised User Account + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 80 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + impact: 90 + kill_chain_phases: + - Reconnaisance + message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ + mitre_attack_id: + - T1201 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.userName + - eventSource + - user_arn + - aws_account_id + - src_ip + risk_score: 72 + security_domain: threat diff --git a/tests/cloud/aws_password_policy_changes.test.yml b/tests/cloud/aws_password_policy_changes.test.yml new file mode 100644 index 0000000000..ce2bbe7eb3 --- /dev/null +++ b/tests/cloud/aws_password_policy_changes.test.yml @@ -0,0 +1,13 @@ +name: AWS Password Policy Changes Unit Test +tests: +- name: AWS Password Policy Changes + file: cloud/aws_password_policy_changes.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true