From bdb357cbc283997cf80307a5a8503456e2a08576 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 28 Feb 2022 11:28:27 -0800 Subject: [PATCH 1/4] detection update --- .../cloud/aws_lambda_updatefunctioncode.yml | 62 +++++++++++++++++++ .../aws_lambda_updatefunctioncode.test.yml | 13 ++++ 2 files changed, 75 insertions(+) create mode 100644 detections/cloud/aws_lambda_updatefunctioncode.yml create mode 100644 tests/cloud/aws_lambda_updatefunctioncode.test.yml diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml new file mode 100644 index 0000000000..5e6e441585 --- /dev/null +++ b/detections/cloud/aws_lambda_updatefunctioncode.yml @@ -0,0 +1,62 @@ +name: AWS Lambda UpdateFunctionCode +id: 211b80d3-6340-4345-11ad-212bf3d0d111 +version: 1 +date: '2022-02-24' +author: Bhavin Patel, Splunk +type: Hunting +datamodel: [] +description: This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. +search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode = success user_type=IAMUser | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.functionName) as function_updated by src_ip user_arn user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`' +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin or an autorized IAM user has updated the lambda code legitimately. +references: +- http://detectioninthe.cloud/execution/modify_lambda_function_code/ +- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/ +tags: + analytic_story: + - Suspicious Cloud User Activities + asset_type: AWS Account + automated_detection_testing: passed + cis20: + - CIS 13 + confidence: 90 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: User $user_arn$ is attempting to create access keys for $requestParameters.userName$ + from this IP $src$ + mitre_attack_id: + - T1204 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + risk_score: 63 + security_domain: cloud diff --git a/tests/cloud/aws_lambda_updatefunctioncode.test.yml b/tests/cloud/aws_lambda_updatefunctioncode.test.yml new file mode 100644 index 0000000000..9a2b157e71 --- /dev/null +++ b/tests/cloud/aws_lambda_updatefunctioncode.test.yml @@ -0,0 +1,13 @@ +name: AWS Lambda UpdateFunctionCode Unit Test +tests: +- name: AWS Lambda UpdateFunctionCode + file: cloud/aws_lambda_updatefunctioncode.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True From 1d19ac2eff950deddbbd90455ce011e874e5c978 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 28 Feb 2022 11:44:33 -0800 Subject: [PATCH 2/4] text updates --- detections/cloud/aws_lambda_updatefunctioncode.yml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml index 5e6e441585..cba2ca43fa 100644 --- a/detections/cloud/aws_lambda_updatefunctioncode.yml +++ b/detections/cloud/aws_lambda_updatefunctioncode.yml @@ -5,12 +5,11 @@ date: '2022-02-24' author: Bhavin Patel, Splunk type: Hunting datamodel: [] -description: This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. +description: This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. In this instance, an attacker may upload malicious code/binary to a lambda function which will be executed automatically when the funnction is triggered. search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode = success user_type=IAMUser | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.functionName) as function_updated by src_ip user_arn user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`' -how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This - search works with AWS CloudTrail logs. +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible - that an AWS admin or an autorized IAM user has updated the lambda code legitimately. + that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately. references: - http://detectioninthe.cloud/execution/modify_lambda_function_code/ - https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/ @@ -24,7 +23,6 @@ tags: confidence: 90 context: - Source:Cloud Data - - Scope:External - Outcome:Allowed - Stage:Execution dataset: @@ -32,8 +30,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: User $user_arn$ is attempting to create access keys for $requestParameters.userName$ - from this IP $src$ + message: User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$ mitre_attack_id: - T1204 nist: From 7321055bc5377a74282cc611c1b6af7ab651dfaf Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 28 Feb 2022 11:59:42 -0800 Subject: [PATCH 3/4] timewindow --- tests/cloud/aws_lambda_updatefunctioncode.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_lambda_updatefunctioncode.test.yml b/tests/cloud/aws_lambda_updatefunctioncode.test.yml index 9a2b157e71..bc47b70de1 100644 --- a/tests/cloud/aws_lambda_updatefunctioncode.test.yml +++ b/tests/cloud/aws_lambda_updatefunctioncode.test.yml @@ -3,7 +3,7 @@ tests: - name: AWS Lambda UpdateFunctionCode file: cloud/aws_lambda_updatefunctioncode.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-7d' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: aws_cloudtrail_events.json From 1273fcec9779fb2f06e4704dcc0c770c8a95a46c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 28 Feb 2022 13:57:59 -0800 Subject: [PATCH 4/4] update giignore for testing --- .gitignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitignore b/.gitignore index afb92a49b6..f7fcc7cdc9 100644 --- a/.gitignore +++ b/.gitignore @@ -115,3 +115,10 @@ package/bin/sftp-config.json package/default/sftp-config.json *.code-snippets notes + +# detection_testing_batch innteractive mode +bin/automated_detection_testing/ci/detection_testing_batch/*-test-run.json +bin/automated_detection_testing/ci/detection_testing_batch/apps/ +bin/automated_detection_testing/ci/detection_testing_batch/security_content/ +bin/automated_detection_testing/ci/detection_testing_batch/test_config.json +bin/automated_detection_testing/ci/detection_testing_batch/test_results/