Branch was auto-updated.

detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml

@@ -1,21 +1,21 @@
 name: AWS Detect Users with KMS keys performing encryption S3
 id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
-version: 1
-date: '2021-01-11'
+version: 2
+date: '2022-11-11'
 author: Rod Soto, Patrick Bareiss Splunk
 type: Anomaly
 datamodel: []
 description: This search provides detection of users with KMS keys performing encryption
   specifically against S3 buckets.
 search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
-  | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source
+  | rename requestParameters.bucketName AS bucketName, requestParameters.x-amz-copy-source
   AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime
-  max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file
+  max(_time) as lastTime values(bucketName) as bucketName values(src_file) AS src_file values(dest_file) AS dest_file
   values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs
-known_false_positives: bucket with S3 encryption
+known_false_positives: There maybe buckets provisioned with S3 encryption
 references:
 - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
 - https://github.com/d1vious/git-wild-hunt

tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml

@@ -1,4 +1,4 @@
-name: AWS ECR Container Scanning Findings Low Informational Unknwon Unit Test
+name: AWS ECR Container Scanning Findings Low Informational Unknown Unit Test
 tests:
 - name: AWS ECR Container Scanning Findings Low Informational Unknown
   file: cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml

tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml

@@ -1,4 +1,4 @@
-name: Creation of lsass dump with taskmgr Unit Test
+name: Creation of lsass Dump with Taskmgr Unit Test
 tests:
 - name: Creation of lsass Dump with Taskmgr
   file: endpoint/creation_of_lsass_dump_with_taskmgr.yml

tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml

@@ -1,6 +1,6 @@
-name: Linux Ingress Tool Transfer With Curl Unit Test
+name: Linux Ingress Tool Transfer with Curl Unit Test
 tests:
-- name: Linux Ingress Tool Transfer With Curl
+- name: Linux Ingress Tool Transfer with Curl
   file: endpoint/linux_ingress_tool_transfer_with_curl.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h

tests/endpoint/suspicious_linux_discovery_commands.test.yml

@@ -1,4 +1,4 @@
-name: Suspicious Linux Discovery Commands
+name: Suspicious Linux Discovery Commands Unit Test
 tests:
 - name: Suspicious Linux Discovery Commands
   file: endpoint/suspicious_linux_discovery_commands.yml

tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml

@@ -1,6 +1,6 @@
-name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test
+name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test
 tests:
-- name: Windows Disabled Users Failing To Authenticate Using Kerberos
+- name: Windows Disabled Users Failing To Authenticate Kerberos
   file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h

tests/endpoint/windows_diskshadow_proxy_execution.test.yml

@@ -1,6 +1,6 @@
-name: Windows Diskshadow proxy execution Unit Test
+name: Windows Diskshadow Proxy Execution Unit Test
 tests:
-- name: Windows Diskshadow proxy execution
+- name: Windows Diskshadow Proxy Execution
   file: endpoint/windows_diskshadow_proxy_execution.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml

@@ -1,6 +1,6 @@
-name: Windows Indirect Command Execution via forfiles Unit Test
+name: Windows Indirect Command Execution Via forfiles Unit Test
 tests:
-- name: Windows Indirect Command Excecution via forfiles
+- name: Windows Indirect Command Execution Via forfiles
   file: endpoint/windows_indirect_command_execution_via_forfiles.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml

@@ -1,6 +1,6 @@
-name: Windows Multi-hop Proxy TOR Website Query Unit Test
+name: Windows Multi hop Proxy TOR Website Query Unit Test
 tests:
-- name: Windows Multi-hop Proxy TOR Website Query
+- name: Windows Multi hop Proxy TOR Website Query
   file: endpoint/windows_multi_hop_proxy_tor_website_query.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h

tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml

@@ -1,6 +1,6 @@
-name: Windows Service Created With Suspicious Service Path Unit Test
+name: Windows Service Created with Suspicious Service Path Unit Test
 tests:
-- name: Windows Service Created With Suspicious Service Path
+- name: Windows Service Created with Suspicious Service Path
   file: endpoint/windows_service_created_with_suspicious_service_path.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h