From 4c242df80ede7dcf7f0892a939e73da5a0bcccdc Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Thu, 19 Aug 2021 14:07:23 +0200
Subject: [PATCH] container upload aws ecr

---
 ...ontainer_upload_outside_business_hours.yml | 64 +++++++++++++++++++
 ...ner_upload_outside_business_hours.test.yml | 13 ++++
 2 files changed, 77 insertions(+)
 create mode 100644 detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
 create mode 100644 tests/cloud/aws_ecr_container_upload_outside_business_hours.test.yml

diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
new file mode 100644
index 0000000000..68fc3ea128
--- /dev/null
+++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
@@ -0,0 +1,64 @@
+name: AWS ECR Container Upload Outside Business Hours
+id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
+version: 1
+date: '2021-08-19'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container
+  Service (ECR). A upload of a new container is normally done during business hours. 
+  When done outside business hours, we want to take a look into it.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 
+  NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.* as *
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, 
+  userName, src_ip, imageTag, registryId, repositoryName
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_upload_outside_business_hours_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: When your development is spreaded in different time zones, 
+  applying this rule can be difficult.
+references:
+- https://attack.mitre.org/techniques/T1204/003/
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Container uploaded outside business hours from $user$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - eventSource
+  - eventName
+  - awsRegion
+  - requestParameters.imageTag
+  - requestParameters.registryId
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
+  risk_score: 49
+  security_domain: network
diff --git a/tests/cloud/aws_ecr_container_upload_outside_business_hours.test.yml b/tests/cloud/aws_ecr_container_upload_outside_business_hours.test.yml
new file mode 100644
index 0000000000..f4590017af
--- /dev/null
+++ b/tests/cloud/aws_ecr_container_upload_outside_business_hours.test.yml
@@ -0,0 +1,13 @@
+name: AWS ECR Container Upload Outside Business Hours Unit Test
+tests:
+- name: AWS ECR Container Upload Outside Business Hours
+  file: cloud/aws_ecr_container_upload_outside_business_hours.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_container_upload.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True