From 5dd64e3fd1ac610ee09fbcaa28a39a970c09f4f8 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 1 Feb 2023 17:01:28 -0800
Subject: [PATCH] aws concurrent detections

---
 ...concurrent_sessions_from_different_ips.yml | 66 +++++++++++++++++++
 ...rrent_sessions_from_different_ips.test.yml | 13 ++++
 2 files changed, 79 insertions(+)
 create mode 100644 detections/cloud/aws_concurrent_sessions_from_different_ips.yml
 create mode 100644 tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml

diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml
new file mode 100644
index 0000000000..0ca09d2ddb
--- /dev/null
+++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml
@@ -0,0 +1,66 @@
+name: AWS Concurrent Sessions From Different Ips
+id: 51c04fdb-2746-465a-b86e-b413a09c9085
+version: 1
+date: '2023-02-01'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an AWS  account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely
+search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" 
+| bin span=5m _time 
+| stats values(userAgent) values(eventName) values(src_ip) as src_ip  dc(src_ip) as distinct_ip_count by _time user_arn 
+| where distinct_ip_count > 1 
+  | `aws_concurrent_sessions_from_different_ips_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://attack.mitre.org/techniques/T1185/
+- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
+- https://github.com/kgretzky/evilginx2
+tags:
+  analytic_story:
+  - Compromised User Account
+  - AWS Identity and Access Management Account
+  asset_type: AWS Accoun
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $user_arn$ has concurrent sessions from more than one unique IP address $src_ip$ in the span of 5 minutes.
+  mitre_attack_id:
+  - T1185
+  nist:
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+   - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 42
+  security_domain: threat
\ No newline at end of file
diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml
new file mode 100644
index 0000000000..4e2664b79b
--- /dev/null
+++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml
@@ -0,0 +1,13 @@
+name: AWS Concurrent Sessions From Different Ips Unit Test
+tests:
+- name: AWS Concurrent Sessions From Different Ips
+  file: cloud/aws_concurrent_sessions_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data:  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true