From bf6804cef773c54b862dcfa52f5648bf455f9696 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 27 Jul 2021 13:57:33 -0700 Subject: [PATCH 1/9] adding spl updates --- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- ...rocesses_used_for_system_network_configuration_discovery.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 31abc1e88a..a43bccb84b 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index ae1f9e1040..67cdc726e9 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -10,7 +10,7 @@ description: This search looks for fast execution of processes used for system n configuration discovery on the endpoint. search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name + max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime From f24ba429857425450f4982a0b147056cdd114dcf Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 27 Jul 2021 14:41:06 -0700 Subject: [PATCH 2/9] aws-cli --- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index a43bccb84b..1953645722 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=[aws-cli* OR userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control From 90191cd1511915c3533365dcaf7ebc44d89e01d8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 27 Jul 2021 14:51:57 -0700 Subject: [PATCH 3/9] risk_update --- detections/cloud/detect_new_open_s3_buckets.yml | 4 ++-- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 13cc222530..f27536431d 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -40,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Actions on Objectives - message: User $user$ has created an open/public bucket $bucketName$ with the following + message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ with the following permissions $permission$ mitre_attack_id: - T1530 @@ -49,7 +49,7 @@ tags: - PR.AC - DE.CM observable: - - name: userName + - name: userIdentity.userName type: User role: - Attacker diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 1953645722..9d15b97e51 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -41,7 +41,7 @@ tags: impact: 60 kill_chain_phases: - Actions on Objectives - message: User $user$ has created an open/public bucket $bucketName$ using AWS CLI + message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ @@ -52,7 +52,7 @@ tags: - PR.AC - DE.CM observable: - - name: userName + - name: userIdentity.userName type: User role: - Attacker From 79af6768570e94becb250f87dfa0f45850aaf177 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 27 Jul 2021 16:45:59 -0700 Subject: [PATCH 4/9] Update detect_new_open_s3_buckets_over_aws_cli.yml --- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 9d15b97e51..4a1bf833ff 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=[aws-cli* OR userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* )eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control From 74e02663410603ea2d1132560c5ab76e9ffbb8d9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 27 Jul 2021 16:50:03 -0700 Subject: [PATCH 5/9] Update detect_new_open_s3_buckets_over_aws_cli.yml --- detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 4a1bf833ff..2b76f5e55c 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* )eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control From ecf2886c4353a0b0cd12d2a0dd9fe5112339ebd4 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 28 Jul 2021 10:52:22 -0700 Subject: [PATCH 6/9] revert --- detections/cloud/detect_new_open_s3_buckets.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index f27536431d..0642d61653 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -40,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Actions on Objectives - message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ with the following + message: User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$ mitre_attack_id: - T1530 @@ -49,7 +49,7 @@ tags: - PR.AC - DE.CM observable: - - name: userIdentity.userName + - name: userName type: User role: - Attacker @@ -73,4 +73,4 @@ tags: - uri - permission risk_score: 48 - security_domain: threat + security_domain: threat \ No newline at end of file From 2fac7f3a74bcf76ad6253329d2ae7ebadccd4934 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 28 Jul 2021 18:19:22 +0000 Subject: [PATCH 7/9] Added detection testing service results inDetect New Open S3 Buckets over AWS CLI --- .../cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 2b76f5e55c..480b108247 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,8 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* + ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control @@ -41,8 +42,8 @@ tags: impact: 60 kill_chain_phases: - Actions on Objectives - message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI - with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ + message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ + using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ mitre_attack_id: From 8c066fcd267810c2870bc04261cce69425c206e4 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 28 Jul 2021 18:20:17 +0000 Subject: [PATCH 8/9] Added detection testing service results inDetect processes used for System Network Configuration Discovery --- ...sed_for_system_network_configuration_discovery.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 67cdc726e9..5b44b6a649 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -10,11 +10,12 @@ description: This search looks for fast execution of processes used for system n configuration discovery on the endpoint. search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name - Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` - | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime - lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`' + max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user + IN ("","unknown") by Processes.dest Processes.process_name Processes.user _time + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` + | search `system_network_configuration_discovery_tools` | transaction dest connected=false + maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name + process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`' how_to_implement: You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or From 04e23cba8b297c4f9df3c95ca7f29326e5369a28 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 28 Jul 2021 11:44:51 -0700 Subject: [PATCH 9/9] search update --- detections/cloud/detect_new_open_s3_buckets.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 0642d61653..f94a99c2f8 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -13,7 +13,7 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime - max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent + max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` ' how_to_implement: You must install the AWS App for Splunk. @@ -40,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Actions on Objectives - message: User $user$ has created an open/public bucket $bucketName$ with the following + message: User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ mitre_attack_id: - T1530 @@ -49,7 +49,7 @@ tags: - PR.AC - DE.CM observable: - - name: userName + - name: user_arn type: User role: - Attacker @@ -67,7 +67,7 @@ tags: - eventSource - eventName - requestParameters.bucketName - - userIdentity.userName + - user_arn - userIdentity.principalId - userAgent - uri