admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated a huge number of detections with datamodels for CREST team.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-02 17:07:28 -08:00
parent b9a848f076
commit 4cb4b5410b
559 changed files with 13163 additions and 13400 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_lambda_updatefunctioncode.yml
+23 -15
View File
@@ -1,18 +1,24 @@
name: AWS Lambda UpdateFunctionCode
id: 211b80d3-6340-4345-11ad-212bf3d0d111
version: 1
date: '2022-02-24'
author: Bhavin Patel, Splunk
type: Hunting
datamodel: []
description: This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. In this instance, an attacker may upload malicious code/binary to a lambda function which will be executed automatically when the funnction is triggered.
search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode = success user_type=IAMUser | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.functionName) as function_updated by src_ip user_arn user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`'
how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
date: '2022-02-24'
description: This analytic is designed to detect IAM users attempting to update/modify
AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS
environment and to facilitate planting backdoors. In this instance, an attacker
may upload malicious code/binary to a lambda function which will be executed automatically
when the funnction is triggered.
how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
your AWS Environment.
id: 211b80d3-6340-4345-11ad-212bf3d0d111
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
name: AWS Lambda UpdateFunctionCode
references:
- http://detectioninthe.cloud/execution/modify_lambda_function_code/
- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode
= success user_type=IAMUser | stats count min(_time) as firstTime max(_time) as
lastTime values(requestParameters.functionName) as function_updated by src_ip user_arn
user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`'
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -30,7 +36,8 @@ tags:
impact: 70
kill_chain_phases:
- Actions on Objectives
message: User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$
message: User $user_arn$ is attempting to update the lambda function code of $function_updated$
from this IP $src_ip$
mitre_attack_id:
- T1204
nist:
@@ -39,21 +46,22 @@ tags:
- DE.CM
observable:
- name: src_ip
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user_arn
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- eventName
- userAgent
- errorCode
- eventName
risk_score: 63
security_domain: cloud
type: Hunting
version: 1