adding new detection

detections/cloud/azure_automation_account_created.yml

@@ -14,7 +14,7 @@ search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure
   | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
   | `azure_automation_account_created_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. 
-  Specifically, this analytic leverages the AuditLogs log category.
+  Specifically, this analytic leverages the Azure Activity log category.
 known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed.
 references:
 - https://docs.microsoft.com/en-us/azure/automation/overview

detections/cloud/azure_automation_runbook_created.yml

@@ -0,0 +1,73 @@
+name: Azure Automation Runbook Created
+id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
+version: 1
+date: '2022-08-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows
+  administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python.
+  Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+search: ' `azure_audit index=main operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded
+  | dedup object
+  | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path` 
+  | `azure_automation_runbook_created_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. 
+  Specifically, this analytic leverages the Azure Activity log category.
+known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
+references:
+- https://docs.microsoft.com/en-us/azure/automation/overview
+- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
+- https://docs.microsoft.com/en-us/azure/automation/manage-runbooks 
+- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
+- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
+- https://attack.mitre.org/techniques/T1136/003/
+tags:
+  analytic_story:
+  - Azure Active Directory Persistence
+  asset_type: Azure 
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log
+  impact: 70
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: A new Azure Automation Runbook $object$ was created by $caller$
+  mitre_attack_id:
+  - T1136
+  - T1136.003
+  nist:
+  - DE.CM
+  observable:
+  - name: object
+    type: Other
+    role:
+    - Victim
+  - name: caller
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - operationName.localizedValue
+  - status.value
+  - object
+  - caller
+  - claims.ipaddr
+  - resourceGroupName
+  - object_path
+  risk_score: 63
+  security_domain: audit

tests/cloud/azure_automation_runbook_created.test.yml

@@ -0,0 +1,13 @@
+name: Azure Automation Runbook Created Unit Test
+tests:
+- name: Azure Automation Runbook Created
+  file: cloud/azure_automation_runbook_created.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-activity.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log
+    source: mscs:azure:audit
+    sourcetype: mscs:azure:audit
+    update_timestamp: true