From 47ad12bfacbb79ed5a2a0e2cc3fe667596bf0a58 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 23 Mar 2023 13:33:39 -0500 Subject: [PATCH] updated names --- ...n.yml => aws_exfiltration_via_ec2_snapshot.yml} | 14 +++++++------- ... => aws_exfiltration_via_ec2_snapshot.test.yml} | 6 +++--- 2 files changed, 10 insertions(+), 10 deletions(-) rename detections/cloud/{aws_ec2_snapshot_possible_exfiltration.yml => aws_exfiltration_via_ec2_snapshot.yml} (68%) rename tests/cloud/{aws_ec2_snapshot_possible_exfiltration.test.yml => aws_exfiltration_via_ec2_snapshot.test.yml} (71%) diff --git a/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml similarity index 68% rename from detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml rename to detections/cloud/aws_exfiltration_via_ec2_snapshot.yml index e2163288ff..19cbc0684f 100644 --- a/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -1,4 +1,4 @@ -name: AWS EC2 Snapshot Possible Exfiltration +name: AWS Exfiltration via EC2 Snapshot id: ac90b339-13fc-4f29-a18c-4abbba1f2171 version: 1 date: '2023-03-22' @@ -6,17 +6,17 @@ author: BHavin P type: Hunting datamodel: - Endpoint -description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a possible exfiltration via EC2 Snapshots. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. -search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") +description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. +search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") src_ip NOT IN ("guardduty.amazonaws.com") | bin _time span=5m | stats count dc(eventName) as distinct_api_calls values(eventName) values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id -| where distinct_api_calls >= 2 | `aws_ec2_snapshot_possible_exfiltration_filter`' +| where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with AWS CloudTrail logs. -known_false_positives: It is possible that an AWS admin has legitimately shared a - snapshot with others for a specific purpose. + search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment. +known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization. references: - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html tags: analytic_story: - Suspicious Cloud Instance Activities diff --git a/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml b/tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml similarity index 71% rename from tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml rename to tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml index a6295f33ec..9e86673bd6 100644 --- a/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml +++ b/tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml @@ -1,7 +1,7 @@ -name: AWS EC2 Snapshot Possible Exfiltration Unit Test +name: AWS Exfiltration via EC2 Snapshot Unit Test tests: -- name: AWS EC2 Snapshot Possible Exfiltration - file: cloud/aws_ec2_snapshot_possible_exfiltration.yml +- name: AWS Exfiltration via EC2 Snapshot + file: cloud/aws_exfiltration_via_ec2_snapshot.yml pass_condition: '| stats count | where count > 0' earliest_time: -7d latest_time: now