diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index ce8c420583..76944c5875 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -1,21 +1,21 @@ name: AWS Detect Users with KMS keys performing encryption S3 id: 884a5f59-eec7-4f4a-948b-dbde18225fdc -version: 1 -date: '2021-01-11' +version: 2 +date: '2022-11-11' author: Rod Soto, Patrick Bareiss Splunk type: Anomaly datamodel: [] description: This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" - | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source + | rename requestParameters.bucketName AS bucketName, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime - max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file + max(_time) as lastTime values(bucketName) as bucketName values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`' -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs -known_false_positives: bucket with S3 encryption +known_false_positives: There maybe buckets provisioned with S3 encryption references: - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/ - https://github.com/d1vious/git-wild-hunt diff --git a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml index e4281030ff..775200689e 100644 --- a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml +++ b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml @@ -1,4 +1,4 @@ -name: AWS ECR Container Scanning Findings Low Informational Unknwon Unit Test +name: AWS ECR Container Scanning Findings Low Informational Unknown Unit Test tests: - name: AWS ECR Container Scanning Findings Low Informational Unknown file: cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml diff --git a/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml b/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml index eaa16e18d4..4f73e8bd93 100644 --- a/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml +++ b/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml @@ -1,4 +1,4 @@ -name: Creation of lsass dump with taskmgr Unit Test +name: Creation of lsass Dump with Taskmgr Unit Test tests: - name: Creation of lsass Dump with Taskmgr file: endpoint/creation_of_lsass_dump_with_taskmgr.yml diff --git a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml index 2683732440..71c498f0a0 100644 --- a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml +++ b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml @@ -1,6 +1,6 @@ -name: Linux Ingress Tool Transfer With Curl Unit Test +name: Linux Ingress Tool Transfer with Curl Unit Test tests: -- name: Linux Ingress Tool Transfer With Curl +- name: Linux Ingress Tool Transfer with Curl file: endpoint/linux_ingress_tool_transfer_with_curl.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h diff --git a/tests/endpoint/suspicious_linux_discovery_commands.test.yml b/tests/endpoint/suspicious_linux_discovery_commands.test.yml index 967f560bc8..e04990afde 100644 --- a/tests/endpoint/suspicious_linux_discovery_commands.test.yml +++ b/tests/endpoint/suspicious_linux_discovery_commands.test.yml @@ -1,4 +1,4 @@ -name: Suspicious Linux Discovery Commands +name: Suspicious Linux Discovery Commands Unit Test tests: - name: Suspicious Linux Discovery Commands file: endpoint/suspicious_linux_discovery_commands.yml diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml index 292e3877c8..fa414309f7 100644 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml @@ -1,6 +1,6 @@ -name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test +name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test tests: -- name: Windows Disabled Users Failing To Authenticate Using Kerberos +- name: Windows Disabled Users Failing To Authenticate Kerberos file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h diff --git a/tests/endpoint/windows_diskshadow_proxy_execution.test.yml b/tests/endpoint/windows_diskshadow_proxy_execution.test.yml index 03f7c1bb61..789fc946bc 100644 --- a/tests/endpoint/windows_diskshadow_proxy_execution.test.yml +++ b/tests/endpoint/windows_diskshadow_proxy_execution.test.yml @@ -1,6 +1,6 @@ -name: Windows Diskshadow proxy execution Unit Test +name: Windows Diskshadow Proxy Execution Unit Test tests: -- name: Windows Diskshadow proxy execution +- name: Windows Diskshadow Proxy Execution file: endpoint/windows_diskshadow_proxy_execution.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml index 0287f2d7a4..d1e512b869 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml @@ -1,6 +1,6 @@ -name: Windows Indirect Command Execution via forfiles Unit Test +name: Windows Indirect Command Execution Via forfiles Unit Test tests: -- name: Windows Indirect Command Excecution via forfiles +- name: Windows Indirect Command Execution Via forfiles file: endpoint/windows_indirect_command_execution_via_forfiles.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml b/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml index 35a55ef276..a1e668e907 100644 --- a/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml +++ b/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml @@ -1,6 +1,6 @@ -name: Windows Multi-hop Proxy TOR Website Query Unit Test +name: Windows Multi hop Proxy TOR Website Query Unit Test tests: -- name: Windows Multi-hop Proxy TOR Website Query +- name: Windows Multi hop Proxy TOR Website Query file: endpoint/windows_multi_hop_proxy_tor_website_query.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h diff --git a/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml index aa5b995982..e70beb347b 100644 --- a/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml +++ b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml @@ -1,6 +1,6 @@ -name: Windows Service Created With Suspicious Service Path Unit Test +name: Windows Service Created with Suspicious Service Path Unit Test tests: -- name: Windows Service Created With Suspicious Service Path +- name: Windows Service Created with Suspicious Service Path file: endpoint/windows_service_created_with_suspicious_service_path.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h