Branch was auto-updated.

detections/cloud/aws_ecr_container_scanning_findings_high.yml

@@ -0,0 +1,61 @@
+name: AWS ECR Container Scanning Findings High
+id: 62721bd2-1d82-4623-b6e6-aac170014423
+version: 1
+date: '2021-08-17'
+author: Patrick Bareiss, Splunk
+type: TTP
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
+  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
+  | spath path=responseElements.imageScanFindings.findings{} output=findings 
+  | mvexpand findings | spath input=findings| search severity=HIGH
+  | rename name as finding_name, description as finding_description, 
+  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
+  | eval finding = finding_name.", ".finding_description
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_scanning_findings_high_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities with severity high found in repository $repositoryName$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repositoryName
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - eventSource
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
+  risk_score: 49
+  security_domain: network

detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml

@@ -0,0 +1,61 @@
+name: AWS ECR Container Scanning Findings Low Informational Unknown
+id: cbc95e44-7c22-443f-88fd-0424478f5589
+version: 1
+date: '2021-08-17'
+author: Patrick Bareiss, Splunk
+type: Hunting
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
+  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
+  | spath path=responseElements.imageScanFindings.findings{} output=findings 
+  | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
+  | rename name as finding_name, description as finding_description, 
+  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
+  | eval finding = finding_name.", ".finding_description
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities with severity high found in repository $repositoryName$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repositoryName
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - eventSource
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
+  risk_score: 49
+  security_domain: network

detections/cloud/aws_ecr_container_scanning_findings_medium.yml

@@ -0,0 +1,61 @@
+name: AWS ECR Container Scanning Findings Medium
+id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
+version: 1
+date: '2021-08-17'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
+  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
+  | spath path=responseElements.imageScanFindings.findings{} output=findings 
+  | mvexpand findings | spath input=findings| search severity=MEDIUM
+  | rename name as finding_name, description as finding_description, 
+  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
+  | eval finding = finding_name.", ".finding_description
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_scanning_findings_medium_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities with severity high found in repository $repositoryName$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repositoryName
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - eventSource
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
+  risk_score: 49
+  security_domain: network

stories/dev_sec_ops.yml

@@ -0,0 +1,24 @@
+name: Dev Sec Ops
+id: 0ca8c38e-631e-4b81-940c-f9c5450ce41e
+version: 1
+date: '2021-08-18'
+author: Patrick Bareiss, Splunk
+description: This story is focused around detecting attacks on a DevSecOps lifeccycle which
+  consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+narrative: DevSecOps is a collaborative framework, which thinks about application and infrastructure 
+  security from the start. This means that security tools are part of the continuous integration and 
+  continuous deployment pipeline. In this analytics story, we focused on detections around the tools
+  used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI
+  as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as
+  Semgrep and Kube-Hunter.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story: DevSecOps
+  category:
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

tests/cloud/aws_ecr_container_scanning_findings_high.test.yml

@@ -0,0 +1,12 @@
+name: AWS ECR Container Scanning Findings High Unit Test
+tests:
+- name: AWS ECR Container Scanning Findings High
+  file: cloud/aws_ecr_container_scanning_findings_high.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_scanning_findings_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail

tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml

@@ -0,0 +1,12 @@
+name: AWS ECR Container Scanning Findings Low Informational Unknwon Unit Test
+tests:
+- name: AWS ECR Container Scanning Findings Low Informational Unknwon
+  file: cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_scanning_findings_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail

tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml

@@ -0,0 +1,12 @@
+name: AWS ECR Container Scanning Findings Medium Unit Test
+tests:
+- name: AWS ECR Container Scanning Findings Medium
+  file: cloud/aws_ecr_container_scanning_findings_medium.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_scanning_findings_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail