Branch was auto-updated.

detections/cloud/kubernetes_nginx_ingress_lfi.yml

@@ -0,0 +1,55 @@
+name: Kubernetes Nginx Ingress LFI
+id: 0f83244b-425b-4528-83db-7a88c5f66e48
+version: 1
+date: '2021-08-20'
+author: Patrick Bareiss, Splunk
+type: TTP
+datamodel: []
+description: This search uses the Kubernetes logs from a nginx ingress controller
+  to detect local file inclusion attacks.
+search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)"
+  | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT
+  lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as
+  status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s"
+  | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status,
+  url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`'
+how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+known_false_positives: unknown
+references:
+- https://github.com/splunk/splunk-connect-for-kubernetes
+- https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: Kubernetes
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Local File Inclusion Attack detected on $host$
+  mitre_attack_id:
+  - T1212
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - raw
+  risk_score: 49
+  security_domain: network
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log
+

detections/cloud/kubernetes_nginx_ingress_rfi.yml

@@ -0,0 +1,54 @@
+name: Kubernetes Nginx Ingress RFI
+id: fc5531ae-62fd-4de6-9c36-b4afdae8ca95
+version: 1
+date: '2021-08-23'
+author: Patrick Bareiss, Splunk
+type: TTP
+datamodel: []
+description: This search uses the Kubernetes logs from a nginx ingress controller
+  to detect remote file inclusion attacks.
+search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)"
+  | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
+  | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name
+  as proxy | stats count min(_time) as firstTime max(_time) as lastTime by src_ip,
+  dest_ip status, url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`'
+how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+known_false_positives: unknown
+references:
+- https://github.com/splunk/splunk-connect-for-kubernetes
+- https://www.netsparker.com/blog/web-security/remote-file-inclusion-vulnerability/
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: Kubernetes
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Remote File Inclusion Attack detected on $host$
+  mitre_attack_id:
+  - T1212
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - raw
+  risk_score: 49
+  security_domain: network
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log
+

lookups/local_file_inclusion_paths.yml

@@ -0,0 +1,7 @@
+description: A list of interesting files in a local file inclusion attack
+filename: local_file_inclusion_paths.csv
+name: local_file_inclusion_paths
+default_match: 'false'
+match_type: WILDCARD(local_file_inclusion_paths)
+min_matches: 1
+case_sensitive_match: 'false'

macros/kubernetes_container_controller.yml

@@ -0,0 +1,3 @@
+definition: sourcetype=kube:container:controller
+description: customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.
+name: kubernetes_container_controller

tests/cloud/kubernetes_nginx_ingress_lfi.test.yml

@@ -0,0 +1,12 @@
+name: Kubernetes Nginx Ingress LFI Unit Test
+tests:
+- name: Kubernetes Nginx Ingress LFI
+  file: cloud/kubernetes_nginx_ingress_lfi.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-365d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: kubernetes_nginx_lfi_attack.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log
+    sourcetype: kube:container:controller
+    source: kubernetes

tests/cloud/kubernetes_nginx_ingress_rfi.test.yml

@@ -0,0 +1,12 @@
+name: Kubernetes Nginx Ingress RFI Unit Test
+tests:
+- name: Kubernetes Nginx Ingress RFI
+  file: cloud/kubernetes_nginx_ingress_rfi.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-365d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: kubernetes_nginx_rfi_attack.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log
+    sourcetype: kube:container:controller
+    source: kubernetes