updated names

detections/cloud/aws_exfiltration_via_ec2_snapshot.yml

@@ -1,4 +1,4 @@
-name: AWS EC2 Snapshot Possible Exfiltration
+name: AWS Exfiltration via EC2 Snapshot
 id: ac90b339-13fc-4f29-a18c-4abbba1f2171
 version: 1
 date: '2023-03-22'
@@ -6,17 +6,17 @@ author: BHavin P
 type: Hunting
 datamodel:
 - Endpoint
-description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a possible exfiltration via EC2 Snapshots. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
-search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") 
+description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
+search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") src_ip NOT IN ("guardduty.amazonaws.com")
 |  bin _time span=5m 
 |  stats count dc(eventName) as distinct_api_calls values(eventName)  values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id 
-| where distinct_api_calls >= 2 | `aws_ec2_snapshot_possible_exfiltration_filter`'
+| where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: It is possible that an AWS admin has legitimately shared a
-  snapshot with others for  a specific purpose.
+  search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment. 
+known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization. 
 references:
 - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities

tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml

@@ -1,7 +1,7 @@
-name: AWS EC2 Snapshot Possible Exfiltration Unit Test
+name: AWS Exfiltration via EC2 Snapshot Unit Test
 tests:
-- name: AWS EC2 Snapshot Possible Exfiltration
-  file: cloud/aws_ec2_snapshot_possible_exfiltration.yml
+- name: AWS Exfiltration via EC2 Snapshot
+  file: cloud/aws_exfiltration_via_ec2_snapshot.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -7d
   latest_time: now