Branch was auto-updated.

bin/docker_detection_tester/modules/validate_args.py

@@ -166,8 +166,8 @@ setup_schema = {
                   },
                   "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
                     "app_number": 3110,
-                    "app_version": "4.5.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
+                    "app_version": "4.5.1",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
                   },
                   "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
                     "app_number": 3088,

bin/docker_detection_tester/test_config_github_actions.json

@@ -102,8 +102,8 @@
     },
     "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
         "app_number": 3110,
-        "app_version": "4.5.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
+        "app_version": "4.5.1",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
     },
     "SPLUNK_TA_FOR_IIS": {
       "app_number": 3185,

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -27,6 +27,7 @@ references: []
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
+  - Compromised User Account
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/aws_concurrent_sessions_from_different_ips.yml

@@ -0,0 +1,70 @@
+name: AWS Concurrent Sessions From Different Ips
+id: 51c04fdb-2746-465a-b86e-b413a09c9085
+version: 1
+date: '2023-02-01'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an AWS IAM account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. 
+  This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate
+  online resources. When a user navigates the AWS Console after authentication, the API call with the event name `DescribeEventAggregates` is registered in the AWS CloudTrail logs. The Splunk Threat Research team leveraged
+  this event name to identify 2 concurrent sessions. The presence of this event occurring from two different IP addresses is highly unlikely.
+  As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. 
+search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" 
+  | bin span=5m _time 
+  | stats values(userAgent) values(eventName) values(src_ip) as src_ip  dc(src_ip) as distinct_ip_count by _time user_arn 
+  | where distinct_ip_count > 1 
+  | `aws_concurrent_sessions_from_different_ips_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://attack.mitre.org/techniques/T1185/
+- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
+- https://github.com/kgretzky/evilginx2
+tags:
+  analytic_story:
+  - Compromised User Account
+  - AWS Identity and Access Management Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $user_arn$ has concurrent sessions from more than one unique IP address $src_ip$ in the span of 5 minutes.
+  mitre_attack_id:
+  - T1185
+  nist:
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 42
+  security_domain: threat

detections/cloud/aws_console_login_failed_during_mfa_challenge.yml

@@ -18,6 +18,7 @@ references:
 tags:
   analytic_story:
   - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
   asset_type: AWS Account
   cis20:
   - CIS 3

detections/cloud/aws_high_number_of_failed_authentications_for_user.yml

@@ -0,0 +1,67 @@
+name: AWS High Number Of Failed Authentications For User
+id: e3236f49-daf3-4b70-b808-9290912ac64d
+version: 1
+date: '2023-01-27'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies an AWS account with more than 20 failed authentication events in the span of 5 minutes. This behavior 
+  could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection.
+search: '`cloudtrail` eventName=ConsoleLogin action=failure 
+  | bucket span=10m _time
+  | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id 
+  | where failed_attempts > 20
+  | `aws_high_number_of_failed_authentications_for_user_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
+tags:
+  analytic_story:
+  - Compromised User Account
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: User $user_name$ failed to authenticate more than 20 times in the span of 5 minutes for AWS Account $aws_account_id$
+  mitre_attack_id:
+  - T1201
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.userName
+  - eventSource
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 35
+  security_domain: threat

detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml

@@ -0,0 +1,69 @@
+name: AWS High Number Of Failed Authentications From Ip
+id: f75b7f1a-b8eb-4975-a214-ff3e0a944757
+version: 1
+date: '2023-01-30'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies an IP address failing to authenticate 20 or more times to the AWS Web Console in the span of 5 minutes. This behavior 
+  could represent a brute force attack against an AWS tenant to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection. 
+search: '`cloudtrail` eventName=ConsoleLogin action=failure
+  | bucket span=5m _time 
+  | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id 
+  | where failed_attempts > 20 
+  | `aws_high_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
+known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
+- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
+tags:
+  analytic_story:
+  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  - T1110.004
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - action
+  - eventName
+  - src_ip
+  risk_score: 54
+  security_domain: threat
+

detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml

@@ -6,7 +6,7 @@ author: Bhavin Patel
 type: Anomaly
 datamodel: []
 description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
-search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
 known_false_positives: No known false postives for this detection. Please review this alert
 references:
@@ -16,6 +16,7 @@ references:
 tags:
   analytic_story:
   - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
   asset_type: AWS Account
   cis20:
   - CIS 3

detections/cloud/aws_new_mfa_method_registered_for_user.yml

@@ -0,0 +1,73 @@
+name: AWS New MFA Method Registered For User
+id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b
+version: 1
+date: '2023-01-31'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies the registration of a new Multi Factor authentication method for an AWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. 
+search: ' `cloudtrail` eventName=CreateVirtualMFADevice 
+  | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `aws_new_mfa_method_registered_for_user_filter`'
+how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
+  search works when AWS CloudTrail logs.
+known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
+references:
+- https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
+- https://attack.mitre.org/techniques/T1556/
+- https://attack.mitre.org/techniques/T1556/006/
+- https://twitter.com/jhencinski/status/1618660062352007174
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: A new virtual device $virtualMFADeviceName$ is added to user  $user_arn$
+  mitre_attack_id:
+  - T1556
+  - T1556.006
+  nist:
+  - DE.CM
+  observable:
+  - name: user_name
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - src_ip
+  - eventName 
+  - eventSource 
+  - requestParameters.virtualMFADeviceName 
+  - errorCode 
+  - userIdentity.principalId
+  - userAgent  
+  - awsRegion
+  - user_name 
+  - userIdentity.arn 
+  - _time
+  risk_score: 64
+  security_domain: identity

detections/cloud/aws_password_policy_changes.yml

@@ -0,0 +1,65 @@
+name: AWS Password Policy Changes
+id: aee4a575-7064-4e60-b511-246f9baf9895
+version: 1
+date: '2023-01-26'
+author: Bhavin Patel, Splunk
+type: Hunting
+datamodel: []
+description: This search looks for AWS CloudTrail events where a user is making successful API calls to view/update/delete the existing password policy in an AWS organization. It is unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised.
+search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success | stats count values(eventName) as eventName values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode  awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`  | `aws_password_policy_changes_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. 
+references:
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json
+  impact: 90
+  kill_chain_phases:
+  - Reconnaissance
+  message: User $user_arn$ is attempting to $eventName$ the password policy for account id $aws_account_id$
+  mitre_attack_id:
+  - T1201
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.userName
+  - eventSource
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 72
+  security_domain: threat

detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml

@@ -0,0 +1,69 @@
+name: AWS Successful Console Authentication From Multiple IPs
+id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb
+version: 1
+date: '2023-01-19'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies an AWS account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent
+  an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user.
+  As users may behave differently across organizations, security teams should test and customize this detection to fit their environments.
+search: ' `cloudtrail` eventName = ConsoleLogin 
+  | bin span=5m _time 
+  | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn 
+  | where distinct_ip_count>1 
+  | `aws_successful_console_authentication_from_multiple_ips_filter`'
+how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
+  search works when AWS CloudTrail events are normalized use the Authentication datamodel.
+known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/
+tags:
+  analytic_story:
+  - Suspicious AWS Login Activities
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 5 mins
+  mitre_attack_id:
+  - T1586
+  - T1535
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.src
+  - Authentication.user
+  - Authentication.signature
+  - Authentication.user_agent
+  - Authentication.action 
+  - Authentication.user_type
+  risk_score: 72
+  security_domain: threat

detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml

@@ -0,0 +1,69 @@
+name: Azure AD Concurrent Sessions From Different Ips
+id: a9126f73-9a9b-493d-96ec-0dd06695490d
+version: 1
+date: '2023-01-24'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip address within the span of 5 minutes. 
+  This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to 
+  access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments.
+search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName
+  | where unique_ips > 1
+  | `azure_ad_concurrent_sessions_from_different_ips_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://attack.mitre.org/techniques/T1185/
+- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
+- https://github.com/kgretzky/evilginx2
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $userPrincipalName$ has concurrent sessions from more than one unique IP address in the span of 5 minutes.
+  mitre_attack_id:
+  - T1185
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  risk_score: 42
+  security_domain: threat

detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml

@@ -0,0 +1,64 @@
+name: Azure AD High Number Of Failed Authentications For User
+id: 630b1694-210a-48ee-a450-6f79e7679f2c
+version: 1
+date: '2023-01-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Azure AD account with more than 20 failed authentication events in the span of 5 minutes. This behavior 
+  could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection.
+search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+| rename properties.* as *
+| bucket span=5m _time
+| stats  dc(_raw) AS failed_attempts  values(ipAddress) by userPrincipalName, _time
+| where failed_attempts > 20
+| `azure_ad_high_number_of_failed_authentications_for_user_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/
+- https://attack.mitre.org/techniques/T1110/001/
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: User $userPrincipalName$ failed to authenticate more than 20 times in the span of 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.001
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  risk_score: 35
+  security_domain: identity

detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml

@@ -0,0 +1,70 @@
+name: Azure AD High Number Of Failed Authentications From Ip
+id: e5ab41bf-745d-4f72-a393-2611151afd8e
+version: 1
+date: '2023-01-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Ip address failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior 
+  could represent a brute force attack againstan Azure AD to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection.
+search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(_raw) AS failed_attempts values(userPrincipalName) by ipAddress, _time
+  | where failed_attempts > 20
+  | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/
+- https://attack.mitre.org/techniques/T1110/001/
+- https://attack.mitre.org/techniques/T1110/003/
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: $ipAddress$ failed to authenticate more than 20 times in the span of 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.001
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  risk_score: 35
+  security_domain: identity

detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml

@@ -0,0 +1,71 @@
+name: Azure AD New MFA Method Registered For User
+id: 2628b087-4189-403f-9044-87403f777a1b
+version: 1
+date: '2023-01-30'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies the registration of a new Multi Factor authentication method for an Azure AD account. Adversaries who have obtained
+  unauthorized access to an Azure AD account may register a new MFA method to maintain persistence. 
+search: ' `azuread` category=AuditLogs operationName="User registered security info" properties.operationType=Add 
+  | rename properties.* as * 
+  | rename targetResources{}.* as *  
+  | stats  values(userPrincipalName) by _time, resultDescription, result, callerIpAddress
+  | `azure_ad_new_mfa_method_registered_for_user_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. 
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
+references:
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
+- https://attack.mitre.org/techniques/T1556/
+- https://attack.mitre.org/techniques/T1556/006/
+- https://twitter.com/jhencinski/status/1618660062352007174
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: UPDATE message
+  mitre_attack_id:
+  - T1556
+  - T1556.006
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: callerIpAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - category
+  - operationName
+  - properties.operationType
+  - userPrincipalName
+  - resultDescription
+  - result
+  - callerIpAddress
+  risk_score: 64
+  security_domain: identity

detections/cloud/azure_ad_successful_authentication_from_different_ips.yml

@@ -0,0 +1,72 @@
+name: Azure AD Successful Authentication From Different Ips
+id: be6d868d-33b6-4aaa-912e-724fb555b11a
+version: 1
+date: '2023-01-24'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Azure AD account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent
+  an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user.
+  As users may behave differently across organizations, security teams should test and customize this detection to fit their environments.
+search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName
+  | where unique_ips > 1
+  | `azure_ad_successful_authentication_from_different_ips_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- T1110
+- T1110.001
+- T1110.003
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $userPrincipalName$ has had successful authentication events from more than one unique IP address in the span of 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.001
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  - properties.appDisplayName
+  risk_score: 56
+  security_domain: identity

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -45,6 +45,7 @@ tags:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
   - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -46,6 +46,7 @@ tags:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
   - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -45,6 +45,7 @@ tags:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
   - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
   asset_type: AWS Instance
   cis20:
   - CIS 16

stories/compromised_user_account.yml

@@ -0,0 +1,18 @@
+name: Compromised User Account
+id: 19669154-e9d1-4a01-b144-e6592a078092
+version: 1
+date: '2023-01-19'
+author: Mauricio Velazco, Bhavin Patel, Splunk
+description: Monitor for activities and techniques associated with Compromised User Account attacks.
+narrative: Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential signs of Compromised User Accounts.
+references:
+- https://www.proofpoint.com/us/threat-reference/compromised-account
+tags:
+  analytic_story: Compromised User Account
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml

@@ -0,0 +1,13 @@
+name: AWS Concurrent Sessions From Different Ips Unit Test
+tests:
+- name: AWS Concurrent Sessions From Different Ips
+  file: cloud/aws_concurrent_sessions_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml

@@ -0,0 +1,13 @@
+name: AWS High Number Of Failed Authentications For User Unit Test
+tests:
+- name: AWS High Number Of Failed Authentications For User
+  file: cloud/aws_high_number_of_failed_authentications_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: AWS High Number Of Failed Authentications From Ip Unit Test
+tests:
+- name: AWS High Number Of Failed Authentications From Ip
+  file: cloud/aws_high_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true

tests/cloud/aws_new_mfa_method_registered_for_user.test.yml

@@ -0,0 +1,13 @@
+name: AWS New MFA Method Registered For User Unit Test
+tests:
+- name: AWS New MFA Method Registered For User
+  file: cloud/aws_new_mfa_method_registered_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/aws_password_policy_changes.test.yml

@@ -0,0 +1,13 @@
+name: AWS Password Policy Changes Unit Test
+tests:
+- name: AWS Password Policy Changes
+  file: cloud/aws_password_policy_changes.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml

@@ -0,0 +1,13 @@
+name: AWS Successful Console Authentication From Multiple IPs Unit Test
+tests:
+- name: AWS Successful Console Authentication From Multiple IPs
+  file: cloud/aws_successful_console_authentication_from_multiple_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -7d
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Concurrent Sessions From Different Ips Unit Test
+tests:
+- name: Azure AD Concurrent Sessions From Different Ips
+  file: cloud/azure_ad_concurrent_sessions_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD High Number Of Failed Authentications For User Unit Test
+tests:
+- name: Azure AD High Number Of Failed Authentications For User
+  file: cloud/azure_ad_high_number_of_failed_authentications_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD High Number Of Failed Authentications From Ip Unit Test
+tests:
+- name: Azure AD High Number Of Failed Authentications From Ip
+  file: cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD New MFA Method Registered For User Unit Test
+tests:
+- name: Azure AD New MFA Method Registered For User
+  file: cloud/azure_ad_new_mfa_method_registered_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Successful Authentication From Different Ips Unit Test
+tests:
+- name: Azure AD Successful Authentication From Different Ips
+  file: cloud/azure_ad_successful_authentication_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true