Merge pull request #1545 from splunk/blackbolt_duplicate

From @https://github.com/BlackB0lt

detections/cloud/detect_new_open_s3_buckets.yml

@@ -13,7 +13,7 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
   | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
   | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") |
   rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime
-  max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent
+  max(_time) as lastTime by user_arn userIdentity.principalId userAgent
   uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_new_open_s3_buckets_filter` '
 how_to_implement: You must install the AWS App for Splunk.
@@ -40,7 +40,7 @@ tags:
   impact: 60
   kill_chain_phases:
   - Actions on Objectives
-  message: User $user$ has created an open/public bucket $bucketName$ with the following
+  message: User $user_arn$ has created an open/public bucket $bucketName$ with the following
     permissions $permission$
   mitre_attack_id:
   - T1530
@@ -49,7 +49,7 @@ tags:
   - PR.AC
   - DE.CM
   observable:
-  - name: userName
+  - name: user_arn
     type: User
     role:
     - Attacker
@@ -67,10 +67,10 @@ tags:
   - eventSource
   - eventName
   - requestParameters.bucketName
-  - userIdentity.userName
+  - user_arn
   - userIdentity.principalId
   - userAgent
   - uri
   - permission
   risk_score: 48
-  security_domain: threat
+  security_domain: threat

detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml

@@ -7,7 +7,8 @@ type: batch
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user has created
   an open/public S3 bucket over the aws cli.
-search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
+search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli*
+  ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control
@@ -41,8 +42,8 @@ tags:
   impact: 60
   kill_chain_phases:
   - Actions on Objectives
-  message: User $user$ has created an open/public bucket $bucketName$ using AWS CLI
-    with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$
+  message: User $userIdentity.userName$ has created an open/public bucket $bucketName$
+    using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$
     $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$
     $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
   mitre_attack_id:
@@ -52,7 +53,7 @@ tags:
   - PR.AC
   - DE.CM
   observable:
-  - name: userName
+  - name: userIdentity.userName
     type: User
     role:
     - Attacker

detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml

@@ -10,11 +10,12 @@ description: This search looks for fast execution of processes used for system n
   configuration discovery on the endpoint.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name
-  Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools`
-  | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime
-  lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`'
+  max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user
+  IN ("","unknown") by Processes.dest Processes.process_name Processes.user _time
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
+  | search `system_network_configuration_discovery_tools` | transaction dest connected=false
+  maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name
+  process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`'
 how_to_implement: You must be ingesting data that records registry activity from your
   hosts to populate the Endpoint data model in the processes node. This is typically
   populated via endpoint detection-and-response product, such as Carbon Black, or