admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

awssamlaccessbyprovideruserandprincipal

Browse Source
This commit is contained in:
Rod Soto
2021-01-26 16:59:56 -05:00
parent af0fa08d34
commit 5facbf0cf8
1 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+39
View File
@@ -0,0 +1,39 @@
author: Rod Soto, Splunk
date: '2021-01-26'
description: This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS.
This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially
in federated environments using SAML protocol inside the perimeter or cloud provider.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
id: bbe23980-6019-11eb-ae93-0242ac130002
known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as
accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress
user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches
can provide the necessary context to detect these attacks.
name: AWS SAML access by provider user and principal
references:
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
search: sourcetype="aws:cloudtrail" Assumerolewithsaml | spath "requestParameters.principalArn" | search "requestParameters.principalArn"=*
| spath "requestParameters.roleArn" | search "requestParameters.roleArn"=* | spath "requestParameters.roleSessionName"
| search "requestParameters.roleSessionName"=* | spath recipientAccountId | search recipientAccountId=*
| spath "responseElements.assumedRoleUser.arn" | search "responseElements.assumedRoleUser.arn"=*
| spath "responseElements.assumedRoleUser.assumedRoleId" | search "responseElements.assumedRoleUser.assumedRoleId"=*
| spath "responseElements.issuer" | search "responseElements.issuer"=* | spath sourceIPAddress | search sourceIPAddress=*
| spath userAgent | search userAgent=*
| table requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId recipientAccountId responseElements.issuer sourceIPAddress userAgent
|`aws_saml_access_by_provider_user_and_principal_filter`'
tags:
analytics_story:
- Cloud Federated Credential Abuse
asset_type: AWS Federated Account
mitre_attack_id:
- T1078
security_domain: threat
automated_detection_testing: n/a
dataset:
- TBU
type: ESCU
version: 1