admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'mustang_beta_test_files' of https://github.com/splunk/security-content into mustang_beta_test_files

Browse Source
This commit is contained in:
Detection Testing Service
2020-12-01 00:02:23 +00:00
parent 740a7e2f89 36fd1141e4
commit 6421ec1b47
1 changed files with 19 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+19 -20
View File
@@ -3,29 +3,25 @@ id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
version: 1
date: '2020-09-12'
description: Find EC2 instances being created with previously unseen instance types.
how_to_implement: "You must be ingesting your cloud infrastructure logs from your
cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial`
to build the initial table of instance types observed and times. You must also enable the second
baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and
to age out old data. You can also provide additional filtering for this search by
customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro."
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Instance
Types - Initial` to build the initial table of instance types observed and times.
You must also enable the second baseline search `Previously Seen Cloud Compute Instance
Types - Update` to keep this table up to date and to age out old data. You can also
provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
macro.
type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count
from datamodel=Change where All_Changes.action=created
by All_Changes.Instance_Changes.instance_type, All_Changes.user
| `drop_dm_object_name("All_Changes")`
| `drop_dm_object_name("Instance_Changes")`
| where instance_type != "unknown"
| lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data
| eventstats max(enough_data) as enough_data
| where enough_data=1
| eval firstTimeSeenInstanceType=min(firstTimeSeen)
| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h")
| table firstTime, user, dest, count, instance_type
| `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
| where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types
instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats
max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen)
| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(),
"-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
known_false_positives: It is possible that an admin will create a new system using
a new instance type that has never been used before. Verify with the creator that
they intended to create the system with the new instance type.
@@ -41,3 +37,6 @@ tags:
risk_score: 20
risk_object_type: user
risk_object: user
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json