From fd0f407862079494f0c546a73e993b2b6366efaf Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 11 Nov 2022 11:35:01 -0800 Subject: [PATCH 1/5] Fix naming of a test --- ...ntainer_scanning_findings_low_informational_unknown.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml index e4281030ff..775200689e 100644 --- a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml +++ b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml @@ -1,4 +1,4 @@ -name: AWS ECR Container Scanning Findings Low Informational Unknwon Unit Test +name: AWS ECR Container Scanning Findings Low Informational Unknown Unit Test tests: - name: AWS ECR Container Scanning Findings Low Informational Unknown file: cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml From 6a628b4ef1da31b2aa06531556477b061170d2a0 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 11 Nov 2022 11:39:29 -0800 Subject: [PATCH 2/5] updated name of another test --- tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml b/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml index eaa16e18d4..4f73e8bd93 100644 --- a/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml +++ b/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml @@ -1,4 +1,4 @@ -name: Creation of lsass dump with taskmgr Unit Test +name: Creation of lsass Dump with Taskmgr Unit Test tests: - name: Creation of lsass Dump with Taskmgr file: endpoint/creation_of_lsass_dump_with_taskmgr.yml From 767e323fc12f98d4bce684afcd9fddc7bce111f7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 11 Nov 2022 11:45:47 -0800 Subject: [PATCH 3/5] spl update --- ..._users_with_kms_keys_performing_encryption_s3.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index ce8c420583..76944c5875 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -1,21 +1,21 @@ name: AWS Detect Users with KMS keys performing encryption S3 id: 884a5f59-eec7-4f4a-948b-dbde18225fdc -version: 1 -date: '2021-01-11' +version: 2 +date: '2022-11-11' author: Rod Soto, Patrick Bareiss Splunk type: Anomaly datamodel: [] description: This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" - | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source + | rename requestParameters.bucketName AS bucketName, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime - max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file + max(_time) as lastTime values(bucketName) as bucketName values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`' -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs -known_false_positives: bucket with S3 encryption +known_false_positives: There maybe buckets provisioned with S3 encryption references: - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/ - https://github.com/d1vious/git-wild-hunt From 20b623765790e10aa5c200fe489b44f2d17c3ecd Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 11 Nov 2022 11:48:47 -0800 Subject: [PATCH 4/5] Updating the names of more tests in test files --- tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml | 4 ++-- tests/endpoint/suspicious_linux_discovery_commands.test.yml | 2 +- ...s_disabled_users_failing_to_authenticate_kerberos.test.yml | 4 ++-- tests/endpoint/windows_diskshadow_proxy_execution.test.yml | 4 ++-- .../windows_indirect_command_execution_via_forfiles.test.yml | 4 ++-- .../windows_multi_hop_proxy_tor_website_query.test.yml | 4 ++-- ...dows_service_created_with_suspicious_service_path.test.yml | 4 ++-- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml index 2683732440..71c498f0a0 100644 --- a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml +++ b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml @@ -1,6 +1,6 @@ -name: Linux Ingress Tool Transfer With Curl Unit Test +name: Linux Ingress Tool Transfer with Curl Unit Test tests: -- name: Linux Ingress Tool Transfer With Curl +- name: Linux Ingress Tool Transfer with Curl file: endpoint/linux_ingress_tool_transfer_with_curl.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h diff --git a/tests/endpoint/suspicious_linux_discovery_commands.test.yml b/tests/endpoint/suspicious_linux_discovery_commands.test.yml index 967f560bc8..e04990afde 100644 --- a/tests/endpoint/suspicious_linux_discovery_commands.test.yml +++ b/tests/endpoint/suspicious_linux_discovery_commands.test.yml @@ -1,4 +1,4 @@ -name: Suspicious Linux Discovery Commands +name: Suspicious Linux Discovery Commands Unit Test tests: - name: Suspicious Linux Discovery Commands file: endpoint/suspicious_linux_discovery_commands.yml diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml index 292e3877c8..fa414309f7 100644 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml @@ -1,6 +1,6 @@ -name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test +name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test tests: -- name: Windows Disabled Users Failing To Authenticate Using Kerberos +- name: Windows Disabled Users Failing To Authenticate Kerberos file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h diff --git a/tests/endpoint/windows_diskshadow_proxy_execution.test.yml b/tests/endpoint/windows_diskshadow_proxy_execution.test.yml index 03f7c1bb61..789fc946bc 100644 --- a/tests/endpoint/windows_diskshadow_proxy_execution.test.yml +++ b/tests/endpoint/windows_diskshadow_proxy_execution.test.yml @@ -1,6 +1,6 @@ -name: Windows Diskshadow proxy execution Unit Test +name: Windows Diskshadow Proxy Execution Unit Test tests: -- name: Windows Diskshadow proxy execution +- name: Windows Diskshadow Proxy Execution file: endpoint/windows_diskshadow_proxy_execution.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml index 0287f2d7a4..4d7b189e44 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml @@ -1,6 +1,6 @@ -name: Windows Indirect Command Execution via forfiles Unit Test +name:Windows Indirect Command Execution Via forfiles Unit Test tests: -- name: Windows Indirect Command Excecution via forfiles +- name: Windows Indirect Command Execution Via forfiles file: endpoint/windows_indirect_command_execution_via_forfiles.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml b/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml index 35a55ef276..a1e668e907 100644 --- a/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml +++ b/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml @@ -1,6 +1,6 @@ -name: Windows Multi-hop Proxy TOR Website Query Unit Test +name: Windows Multi hop Proxy TOR Website Query Unit Test tests: -- name: Windows Multi-hop Proxy TOR Website Query +- name: Windows Multi hop Proxy TOR Website Query file: endpoint/windows_multi_hop_proxy_tor_website_query.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h diff --git a/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml index aa5b995982..e70beb347b 100644 --- a/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml +++ b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml @@ -1,6 +1,6 @@ -name: Windows Service Created With Suspicious Service Path Unit Test +name: Windows Service Created with Suspicious Service Path Unit Test tests: -- name: Windows Service Created With Suspicious Service Path +- name: Windows Service Created with Suspicious Service Path file: endpoint/windows_service_created_with_suspicious_service_path.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From 75f5c26163dce220b8de382d6cfc8d48eec059d1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 11 Nov 2022 11:50:02 -0800 Subject: [PATCH 5/5] Missing space in yml file --- .../windows_indirect_command_execution_via_forfiles.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml index 4d7b189e44..d1e512b869 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml @@ -1,4 +1,4 @@ -name:Windows Indirect Command Execution Via forfiles Unit Test +name: Windows Indirect Command Execution Via forfiles Unit Test tests: - name: Windows Indirect Command Execution Via forfiles file: endpoint/windows_indirect_command_execution_via_forfiles.yml