From d78f2a9eb7a7638abc8752467ea142b3dc814de7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 19 Jan 2023 17:01:48 -0500 Subject: [PATCH 01/34] new analytic story --- stories/compromised_user_account.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 stories/compromised_user_account.yml diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml new file mode 100644 index 0000000000..e530f12edb --- /dev/null +++ b/stories/compromised_user_account.yml @@ -0,0 +1,16 @@ +name: Compromised User Account +id: 19669154-e9d1-4a01-b144-e6592a078092 +version: 1 +date: '2023-01-19' +author: Mauricio Velazco, Bhavin Patel, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: Compromised User Account + category: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 05aca8a58eddc55c894b00b032a45a6274e7858c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 19 Jan 2023 15:49:02 -0800 Subject: [PATCH 02/34] new aws detection --- .../aws_console_logins_from_multiple_ips.yml | 67 +++++++++++++++++++ ..._console_logins_from_multiple_ips.test.yml | 13 ++++ 2 files changed, 80 insertions(+) create mode 100644 detections/cloud/aws_console_logins_from_multiple_ips.yml create mode 100644 tests/cloud/aws_console_logins_from_multiple_ips.test.yml diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml new file mode 100644 index 0000000000..7a5eb822ef --- /dev/null +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -0,0 +1,67 @@ +name: AWS Console Logins From Multiple IPs +id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb +version: 1 +date: '2023-01-19' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: +- Authentication +description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 5 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime dc(Authentication.src) as distinct_ip_count values(Authentication.src) as src_ip values(Authentication.user_agent) as user_agent values(Authentication.action) as action from datamodel=Authentication + where Authentication.signature=ConsoleLogin by _time span=5m Authentication.user Authentication.user_type +| `drop_dm_object_name(Authentication)` +| where distinct_ip_count >= 2 | `aws_console_logins_from_multiple_ips_filter`' +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This + search works when AWS CloudTrail events are normalized use the Authentication datamodel. +known_false_positives: It is highly unlikely to have two login attempts from entirely differnt IP addresses. +references: +- https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/ +tags: + analytic_story: + - Suspicious AWS Login Activities + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 80 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: User $user$ has successfully logged into the AWS Console from different IP addresses $src$ with 5 mins + mitre_attack_id: + - T1586 + - T1586.003 + - T1535 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Authentication.src + - Authentication.user + - Authentication.signature + - Authentication.user_agent + - Authentication.action + - Authentication.user_type + risk_score: 72 + security_domain: threat diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml new file mode 100644 index 0000000000..2fe61c69da --- /dev/null +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -0,0 +1,13 @@ +name: AWS Console Logins From Multiple IPs Unit Test +tests: +- name: AWS Console Logins From Multiple IPs + file: cloud/aws_console_logins_from_multiple_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From 4b24cc6d533d20e009ebea6baa9d10a6dd9bfdab Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 19 Jan 2023 16:01:20 -0800 Subject: [PATCH 03/34] tagging aws relevant detection draft --- .../abnormally_high_number_of_cloud_infrastructure_api_calls.yml | 1 + .../cloud/aws_console_login_failed_during_mfa_challenge.yml | 1 + detections/cloud/aws_console_logins_from_multiple_ips.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_city.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_country.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index b9b1648f44..7ea17bbea4 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -27,6 +27,7 @@ references: [] tags: analytic_story: - Suspicious Cloud User Activities + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml index 38b241aff2..a99ad315ee 100644 --- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -18,6 +18,7 @@ references: tags: analytic_story: - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index 7a5eb822ef..40d881cbed 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -19,6 +19,7 @@ references: tags: analytic_story: - Suspicious AWS Login Activities + - Compromised User Account asset_type: AWS Account cis20: - CIS 13 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 8e9b146e12..f532929c78 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -45,6 +45,7 @@ tags: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index e7c56a9109..c04c3450c0 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -46,6 +46,7 @@ tags: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index e488247f0d..2d05ca3bd0 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -45,6 +45,7 @@ tags: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 From 090e5c4bee27e2a77512e864b4b156a600e5e4e6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 19 Jan 2023 16:38:20 -0800 Subject: [PATCH 04/34] yml changes --- detections/cloud/aws_console_logins_from_multiple_ips.yml | 1 - tests/cloud/aws_console_logins_from_multiple_ips.test.yml | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index 40d881cbed..d1785df1d2 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -37,7 +37,6 @@ tags: message: User $user$ has successfully logged into the AWS Console from different IP addresses $src$ with 5 mins mitre_attack_id: - T1586 - - T1586.003 - T1535 nist: - PR.DS diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml index 2fe61c69da..42d59f1013 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - file_name: cloudtrail.json + - file_name: cloudtrail.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail From 5f165066974b1c72b1c858b8f36ce4c005dbb886 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 23 Jan 2023 17:31:48 -0500 Subject: [PATCH 05/34] adding new azure ad brute force detection --- ...ber_of_failed_authentications_for_user.yml | 63 +++++++++++++++++++ stories/compromised_user_account.yml | 2 +- ...f_failed_authentications_for_user.test.yml | 13 ++++ 3 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml create mode 100644 tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml new file mode 100644 index 0000000000..d1b8611199 --- /dev/null +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -0,0 +1,63 @@ +name: Azure AD High Number Of Failed Authentications For User +id: 630b1694-210a-48ee-a450-6f79e7679f2c +version: 1 +date: '2023-01-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies an Azure AD account with more than 20 failed authentication events in the span of 5 minutes. This behavior + could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. +search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false +| rename properties.* as * +| bucket span=5m _time +| stats dc(_raw) AS failed_attempts values(ipAddress) by userPrincipalName, _time +| where failed_attempts > 20 +| `azure_ad_high_number_of_failed_authentications_for_user_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. +references: +- https://attack.mitre.org/techniques/T1110/001/ +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + impact: 50 + kill_chain_phases: + - Exploitation + message: User $userPrincipalName$ failed to authenticate more than 20 times in the span of 5 minutes. + mitre_attack_id: + - T1110 + - T1110.001 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 35 + security_domain: identity diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index e530f12edb..d73a0510ae 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -3,7 +3,7 @@ id: 19669154-e9d1-4a01-b144-e6592a078092 version: 1 date: '2023-01-19' author: Mauricio Velazco, Bhavin Patel, Splunk -description: UPDATE_DESCRIPTION +description: Monitor for activities and techniques associated with Compromised User Account attacks. narrative: UPDATE_NARRATIVE references: [] tags: diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml new file mode 100644 index 0000000000..0e25e156c4 --- /dev/null +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml @@ -0,0 +1,13 @@ +name: Azure AD High Number Of Failed Authentications For User Unit Test +tests: +- name: Azure AD High Number Of Failed Authentications For User + file: cloud/azure_ad_high_number_of_failed_authentications_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true \ No newline at end of file From a7f6ddbfeb2cc50914cd8c6ff3d2d9b5b0fbb984 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 23 Jan 2023 20:46:00 -0500 Subject: [PATCH 06/34] adding new azure ad brute force detection --- ...ber_of_failed_authentications_for_user.yml | 1 + ...mber_of_failed_authentications_from_ip.yml | 69 +++++++++++++++++++ ...f_failed_authentications_for_user.test.yml | 2 +- ...of_failed_authentications_from_ip.test.yml | 13 ++++ 4 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml create mode 100644 tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index d1b8611199..44a7660637 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -19,6 +19,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro log category. known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. references: +- https://attack.mitre.org/techniques/T1110/ - https://attack.mitre.org/techniques/T1110/001/ tags: analytic_story: diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..8c0c20cf28 --- /dev/null +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,69 @@ +name: Azure AD High Number Of Failed Authentications From Ip +id: e5ab41bf-745d-4f72-a393-2611151afd8e +version: 1 +date: '2023-01-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an Ip address which failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior + could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. +search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false + | rename properties.* as * + | bucket span=5m _time + | stats dc(_raw) AS failed_attempts values(userPrincipalName) by ipAddress, _time + | where failed_attempts > 20 + | `azure_ad_high_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. +references: +- https://attack.mitre.org/techniques/T1110/ +- https://attack.mitre.org/techniques/T1110/001/ +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $ipAddress$ failed to authenticate more than 20 times in the span of 5 minutes. + mitre_attack_id: + - T1110 + - T1110.001 + - T1110.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 35 + security_domain: identity diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml index 0e25e156c4..5ca2a596ea 100644 --- a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: azure-audit.log + - file_name: azuread.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..2fd8ca9235 --- /dev/null +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: Azure AD High Number Of Failed Authentications From Ip Unit Test +tests: +- name: Azure AD High Number Of Failed Authentications From Ip + file: cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From faedd6645ab76e23e31456fc85a0d251319ba71a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 24 Jan 2023 14:02:06 -0500 Subject: [PATCH 07/34] adding new detection for azure ad session hijacking --- ...concurrent_sessions_from_different_ips.yml | 68 +++++++++++++++++++ ...ber_of_failed_authentications_for_user.yml | 3 +- ...rrent_sessions_from_different_ips.test.yml | 13 ++++ 3 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml create mode 100644 tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml new file mode 100644 index 0000000000..72df8ef9c7 --- /dev/null +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,68 @@ +name: Azure AD Concurrent Sessions From Different Ips +id: a9126f73-9a9b-493d-96ec-0dd06695490d +version: 1 +date: '2023-01-24' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip addresses within the span of 5 minutes. + This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to + access corporate online resources. As users may behave different across organizations, security teams should test and customize this detection to fit their environments. +search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs + | rename properties.* as * + | bucket span=5m _time + | stats dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName + | where unique_ips > 1 + | `azure_ad_concurrent_sessions_from_different_ips_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. +references: +- https://attack.mitre.org/techniques/T1185/ +- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/ +- https://github.com/kgretzky/evilginx2 +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log + impact: 70 + kill_chain_phases: + - Exploitation + message: User $userPrincipalName$ has concurrent sessions from more than one unique IP address in the span of 5 minutes. + mitre_attack_id: + - T1185 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 42 + security_domain: threat diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index 44a7660637..476a04a4a2 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-01-23' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies an Azure AD account with more than 20 failed authentication events in the span of 5 minutes. This behavior could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false diff --git a/tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml new file mode 100644 index 0000000000..553df17d5f --- /dev/null +++ b/tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Concurrent Sessions From Different Ips Unit Test +tests: +- name: Azure AD Concurrent Sessions From Different Ips + file: cloud/azure_ad_concurrent_sessions_from_different_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 0c79ce7d966d018142f2567c90b0eddb33d6104b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 24 Jan 2023 18:50:51 -0500 Subject: [PATCH 08/34] adding new detection --- ...concurrent_sessions_from_different_ips.yml | 4 +- ...sful_authentication_from_different_ips.yml | 70 +++++++++++++++++++ ...authentication_from_different_ips.test.yml | 13 ++++ 3 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml create mode 100644 tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index 72df8ef9c7..6d57a712bc 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -5,9 +5,9 @@ date: '2023-01-24' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip addresses within the span of 5 minutes. +description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip address within the span of 5 minutes. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to - access corporate online resources. As users may behave different across organizations, security teams should test and customize this detection to fit their environments. + access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs | rename properties.* as * | bucket span=5m _time diff --git a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml new file mode 100644 index 0000000000..75f3890ac1 --- /dev/null +++ b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml @@ -0,0 +1,70 @@ +name: Azure AD Succesful Authentication From Different Ips +id: be6d868d-33b6-4aaa-912e-724fb555b11a +version: 1 +date: '2023-01-24' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an Azure AD account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent + an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user. + As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. +search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs + | rename properties.* as * + | bucket span=5m _time + | stats dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName + | where unique_ips > 1 + | `azure_ad_succesful_authentication_from_different_ips_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. +references: +- T1110 +- T1110.001 +- T1110.003 +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + impact: 70 + kill_chain_phases: + - Exploitation + message: User $userPrincipalName$ has had successful authentication events from more than one unique IP address in the span of 5 minutes. + mitre_attack_id: + - T1110 + - T1110.001 + - T1110.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 56 + security_domain: identity \ No newline at end of file diff --git a/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml b/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml new file mode 100644 index 0000000000..61fc50f54d --- /dev/null +++ b/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Succesful Authentication From Different Ips Unit Test +tests: +- name: Azure AD Succesful Authentication From Different Ips + file: cloud/azure_ad_succesful_authentication_from_different_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 9f0394613d68270da178115cbe21b81f6af567fb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Jan 2023 11:13:28 -0500 Subject: [PATCH 09/34] updating microsoft cloud services app metadata --- bin/docker_detection_tester/modules/validate_args.py | 4 ++-- bin/docker_detection_tester/test_config_github_actions.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index de10ed4d92..fd02b34df5 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -166,8 +166,8 @@ setup_schema = { }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" }, "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { "app_number": 3088, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 5980af4f03..5e6ba7915d 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -102,8 +102,8 @@ }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" }, "SPLUNK_TA_FOR_IIS": { "app_number": 3185, From 5306030d749eaaedd39759a346b5ab5c1ea153f2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Jan 2023 16:35:43 -0500 Subject: [PATCH 10/34] fixes --- .../test_config_bak.json | 123 ++++++++++++++++++ ...concurrent_sessions_from_different_ips.yml | 1 + ...ber_of_failed_authentications_for_user.yml | 1 + ...mber_of_failed_authentications_from_ip.yml | 1 + ...sful_authentication_from_different_ips.yml | 1 + ...f_failed_authentications_for_user.test.yml | 2 +- ...of_failed_authentications_from_ip.test.yml | 2 +- 7 files changed, 129 insertions(+), 2 deletions(-) create mode 100644 bin/docker_detection_tester/test_config_bak.json diff --git a/bin/docker_detection_tester/test_config_bak.json b/bin/docker_detection_tester/test_config_bak.json new file mode 100644 index 0000000000..e6e2354d16 --- /dev/null +++ b/bin/docker_detection_tester/test_config_bak.json @@ -0,0 +1,123 @@ +{ + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "2.2.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.4.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "2.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.4.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { + "app_number": 3110, + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" + } + }, + "branch": "TR-2326_migrate_password_spraying_xml", + "commit_hash": null, + "container_tag": "latest", + "detections_list": [ + "security_content/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml", + "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml", + "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml", + "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml", + "security_content/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml", + "security_content/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml", + "security_content/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml", + "security_content/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml"], + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": true, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "selected", + "no_interactive_failure": false, + "num_containers": 1, + "persist_security_content": true, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index 6d57a712bc..b2d8e8f2a2 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index 476a04a4a2..45e9035ff5 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -23,6 +23,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml index 8c0c20cf28..4e170cd933 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml index 75f3890ac1..55a1ab4bd8 100644 --- a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml index 5ca2a596ea..e2905d468e 100644 --- a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: azuread.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true \ No newline at end of file diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml index 2fd8ca9235..c22f665da0 100644 --- a/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: azuread.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true From 8a8a7b3173336b8909270a077af868063e43b0f7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Jan 2023 17:06:13 -0500 Subject: [PATCH 11/34] updating analytic story description --- stories/compromised_user_account.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index d73a0510ae..74b5eea652 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -4,8 +4,9 @@ version: 1 date: '2023-01-19' author: Mauricio Velazco, Bhavin Patel, Splunk description: Monitor for activities and techniques associated with Compromised User Account attacks. -narrative: UPDATE_NARRATIVE -references: [] +narrative: Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential signs of Compromised User Accounts. +references: +- https://www.proofpoint.com/us/threat-reference/compromised-account tags: analytic_story: Compromised User Account category: [] From 2ff71df1b0fd97074dff3bec17269f847c4e2b26 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 26 Jan 2023 17:11:29 -0800 Subject: [PATCH 12/34] new detection and update 1 --- ..._users_failing_to_authenticate_from_ip.yml | 2 +- .../cloud/aws_password_policy_changes.yml | 66 +++++++++++++++++++ .../aws_password_policy_changes.test.yml | 13 ++++ 3 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/aws_password_policy_changes.yml create mode 100644 tests/cloud/aws_password_policy_changes.test.yml diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 2526a342ff..1a5c67bad6 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -6,7 +6,7 @@ author: Bhavin Patel type: Anomaly datamodel: [] description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives: No known false postives for this detection. Please review this alert references: diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml new file mode 100644 index 0000000000..a0a6a4610e --- /dev/null +++ b/detections/cloud/aws_password_policy_changes.yml @@ -0,0 +1,66 @@ +name: AWS Password Policy Changes +id: aee4a575-7064-4e60-b511-246f9baf9895 +version: 1 +date: '2023-01-26' +author: Bhavin Patel, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. +search: '`cloudtrail` eventName=*PasswordPolicy errorCode=success | stats count values(eventName) values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +references: +- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + - Compromised User Account + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 80 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + impact: 90 + kill_chain_phases: + - Reconnaisance + message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ + mitre_attack_id: + - T1201 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.userName + - eventSource + - user_arn + - aws_account_id + - src_ip + risk_score: 72 + security_domain: threat diff --git a/tests/cloud/aws_password_policy_changes.test.yml b/tests/cloud/aws_password_policy_changes.test.yml new file mode 100644 index 0000000000..ce2bbe7eb3 --- /dev/null +++ b/tests/cloud/aws_password_policy_changes.test.yml @@ -0,0 +1,13 @@ +name: AWS Password Policy Changes Unit Test +tests: +- name: AWS Password Policy Changes + file: cloud/aws_password_policy_changes.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 6d2aea64cc4653fbbb8c1564e147d66e7d80fbfb Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 26 Jan 2023 17:14:53 -0800 Subject: [PATCH 13/34] minor fix --- detections/cloud/aws_password_policy_changes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index a0a6a4610e..4bb22f1797 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -31,7 +31,7 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json impact: 90 kill_chain_phases: - - Reconnaisance + - Reconnaissance message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ mitre_attack_id: - T1201 From 03598ec031eb32cf9d7c158ca4fb86e78d901fd4 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Jan 2023 16:58:28 -0800 Subject: [PATCH 14/34] new detectiono aws --- ...ber_of_failed_authentications_for_user.yml | 63 +++++++++++++++++++ ...f_failed_authentications_for_user.test.yml | 12 ++++ 2 files changed, 75 insertions(+) create mode 100644 detections/cloud/aws_high_number_of_failed_authentications_for_user.yml create mode 100644 tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml new file mode 100644 index 0000000000..3e60fc1946 --- /dev/null +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -0,0 +1,63 @@ +name: AWS High Number Of Failed Authentications For User +id: e3236f49-daf3-4b70-b808-9290912ac64d +version: 1 +date: '2023-01-27' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: [] +description: The following analytic identifies an AWS IAM User account with more than 20 failed authentication events in the span of 10 minutes. This behavior could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id | where failed_attempts > 20 | `aws_high_number_of_failed_authentications_for_user_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +references: +- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html +tags: + analytic_story: + - Compromised User Account + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 70 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json + impact: 50 + kill_chain_phases: + - Exploitation + message: User $user_name$ failed to authenticate more than 20 times in the span of 5 minutes for AWS Account $aws_account_id$ + mitre_attack_id: + - T1201 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.userName + - eventSource + - user_arn + - aws_account_id + - src_ip + risk_score: 35 + security_domain: threat diff --git a/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml new file mode 100644 index 0000000000..40481d63f4 --- /dev/null +++ b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml @@ -0,0 +1,12 @@ +name: AWS High Number Of Failed Authentications For User Unit Test +tests: +- name: AWS High Number Of Failed Authentications For User + file: cloud/aws_high_number_of_failed_authentications_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From a7e908313a9d8c557af95e47299970ce3d739c07 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Jan 2023 17:10:02 -0800 Subject: [PATCH 15/34] timeframe in test --- tests/cloud/aws_console_logins_from_multiple_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml index 42d59f1013..547ec29026 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -3,7 +3,7 @@ tests: - name: AWS Console Logins From Multiple IPs file: cloud/aws_console_logins_from_multiple_ips.yml pass_condition: '| stats count | where count > 0' - earliest_time: -24h + earliest_time: -7dh latest_time: now attack_data: - file_name: cloudtrail.json From 54459489c1c4cb041f7ec007cdbc4d82e65ea524 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Jan 2023 17:11:53 -0800 Subject: [PATCH 16/34] new line remove --- lookups/REFERENCE_CACHE.db.db | Bin 0 -> 16384 bytes .../cloud/aws_password_policy_changes.test.yml | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 lookups/REFERENCE_CACHE.db.db diff --git a/lookups/REFERENCE_CACHE.db.db b/lookups/REFERENCE_CACHE.db.db new file mode 100644 index 0000000000000000000000000000000000000000..6558e5f59cd95c00adc7f97e6dcf68a70328ce6e GIT binary patch literal 16384 zcmeIu!41MN5Cp&tL?{m)eCQ!r%d)PcZuT!SBIES>gjOFnCIxo=5M$-F1G z(&m~>C2D2qO}TFe=bmfHx~A9T`99kEMytLZ7fbu Date: Fri, 27 Jan 2023 17:23:05 -0800 Subject: [PATCH 17/34] update test file --- .../aws_high_number_of_failed_authentications_for_user.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml index 40481d63f4..fe2fe784d0 100644 --- a/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml +++ b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml @@ -5,6 +5,7 @@ tests: pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now + attack_data: - file_name: cloudtrail.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json sourcetype: aws:cloudtrail From 14edea4ca075dc75cd8ef931467fbecf9d177d6e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Jan 2023 13:10:13 -0800 Subject: [PATCH 18/34] new aws detection --- ...mber_of_failed_authentications_from_ip.yml | 49 +++++++++++++++++++ ..._users_failing_to_authenticate_from_ip.yml | 1 + ...of_failed_authentications_from_ip.test.yml | 13 +++++ 3 files changed, 63 insertions(+) create mode 100644 detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml create mode 100644 tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..08078abbc8 --- /dev/null +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,49 @@ +name: AWS High Number Of Failed Authentications From Ip +id: f75b7f1a-b8eb-4975-a214-ff3e0a944757 +version: 1 +date: '2023-01-30' +author: '' +type: Anomaly +datamodel: +- Endpoint +description: UPDATE_DESCRIPTION +search: '| UPDATE_SPL | `aws_high_number_of_failed_authentications_from_ip_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: UPDATE value between 1-100 + kill_chain_phases: + - Reconnaissance + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: UPDATE (impact * confidence)/100 + security_domain: threat diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 1a5c67bad6..52529ad829 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -16,6 +16,7 @@ references: tags: analytic_story: - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Account cis20: - CIS 3 diff --git a/tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..eba42f5b51 --- /dev/null +++ b/tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: AWS High Number Of Failed Authentications From Ip Unit Test +tests: +- name: AWS High Number Of Failed Authentications From Ip + file: cloud/aws_high_number_of_failed_authentications_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true \ No newline at end of file From b629b14dca31eeef0297ded52c407ae1fff6b0d7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Jan 2023 13:38:41 -0800 Subject: [PATCH 19/34] spl and yaml updates --- ...mber_of_failed_authentications_from_ip.yml | 60 ++++++++++++------- 1 file changed, 38 insertions(+), 22 deletions(-) diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml index 08078abbc8..6a257101c0 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -2,48 +2,64 @@ name: AWS High Number Of Failed Authentications From Ip id: f75b7f1a-b8eb-4975-a214-ff3e0a944757 version: 1 date: '2023-01-30' -author: '' +author: Bhavin Patel, Splunk type: Anomaly -datamodel: -- Endpoint -description: UPDATE_DESCRIPTION -search: '| UPDATE_SPL | `aws_high_number_of_failed_authentications_from_ip_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +datamodel: [] +description: The following analytic identifies an IP address which failing to authenticate 20 or more times to an AWS Web Console in the span of 10 minutes. This behavior + could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id | where failed_attempts > 20 |`aws_high_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. +known_false_positives: No known false postives for this detection. Please review this alert references: -- REFERENCE +- https://attack.mitre.org/techniques/T1110/003/ +- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ tags: analytic_story: - - UPDATE_STORY_NAME - asset_type: UPDATE asset_type + - AWS Identity and Access Management Account Takeover + - Compromised User Account + asset_type: AWS Account cis20: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 90 context: - - Update context + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force dataset: - - UPDATE_DATASET_URL - impact: UPDATE value between 1-100 + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + impact: 60 kill_chain_phases: - - Reconnaissance - Exploitation - message: UPDATE message + message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$ mitre_attack_id: - - T1003.002 + - T1110 + - T1110.003 + - T1110.004 nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: src_ip + type: IP Address role: - - UPDATE + - Attacker + - name: tried_accounts + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - UPDATE - risk_score: UPDATE (impact * confidence)/100 + - _time + - user + - action + - eventName + - src_ip + risk_score: 54 security_domain: threat + From 8dd93e3149100ac0a205807d3e28b05d7a27a844 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 30 Jan 2023 17:33:25 -0500 Subject: [PATCH 20/34] adding new detection --- ..._ad_new_mfa_method_registered_for_user.yml | 71 +++++++++++++++++++ ...ew_mfa_method_registered_for_user.test.yml | 13 ++++ 2 files changed, 84 insertions(+) create mode 100644 detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml create mode 100644 tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml diff --git a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml new file mode 100644 index 0000000000..2f7fe31bdb --- /dev/null +++ b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml @@ -0,0 +1,71 @@ +name: Azure AD New MFA Method Registered For User +id: 2628b087-4189-403f-9044-87403f777a1b +version: 1 +date: '2023-01-30' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the registration of a new Multi Factor authentication method for an Azure AD account. Adversaries who have obtained + unauthorized access to an Azure AD account may register a new MFA method to maintain persistence. +search: ' `azuread` category=AuditLogs operationName="User registered security info" properties.operationType=Add + | rename properties.* as * + | rename targetResources{}.* as * + | stats values(userPrincipalName) by _time, resultDescription, result, callerIpAddress + | `azure_ad_new_mfa_method_registered_for_user_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://attack.mitre.org/techniques/T1556/ +- https://attack.mitre.org/techniques/T1556/006/ +- https://twitter.com/jhencinski/status/1618660062352007174 +tags: + analytic_story: + - Compromised User Account + - Azure Active Directory Account Takeover + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1556 + - T1556.006 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: callerIpAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - category + - operationName + - properties.operationType + - userPrincipalName + - resultDescription + - result + - callerIpAddress + risk_score: 64 + security_domain: identity diff --git a/tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml b/tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml new file mode 100644 index 0000000000..a40ab04c73 --- /dev/null +++ b/tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml @@ -0,0 +1,13 @@ +name: Azure AD New MFA Method Registered For User Unit Test +tests: +- name: Azure AD New MFA Method Registered For User + file: cloud/azure_ad_new_mfa_method_registered_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 71273d8fe1309f0553380c74df85d1af9f1cc650 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Jan 2023 15:13:45 -0800 Subject: [PATCH 21/34] fix the errors --- detections/cloud/aws_console_logins_from_multiple_ips.yml | 4 ++-- detections/cloud/aws_password_policy_changes.yml | 2 +- tests/cloud/aws_password_policy_changes.test.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index d1785df1d2..8d5be295c7 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -6,9 +6,9 @@ author: Bhavin Patel, Splunk type: Anomaly datamodel: - Authentication -description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 5 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. +description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 10 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime dc(Authentication.src) as distinct_ip_count values(Authentication.src) as src_ip values(Authentication.user_agent) as user_agent values(Authentication.action) as action from datamodel=Authentication - where Authentication.signature=ConsoleLogin by _time span=5m Authentication.user Authentication.user_type + where Authentication.signature=ConsoleLogin by _time span=10m Authentication.user Authentication.user_type | `drop_dm_object_name(Authentication)` | where distinct_ip_count >= 2 | `aws_console_logins_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index 4bb22f1797..4f13317d3d 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -28,7 +28,7 @@ tags: - Outcome:Allowed - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json impact: 90 kill_chain_phases: - Reconnaissance diff --git a/tests/cloud/aws_password_policy_changes.test.yml b/tests/cloud/aws_password_policy_changes.test.yml index 3b5388a3b5..eba0438dff 100644 --- a/tests/cloud/aws_password_policy_changes.test.yml +++ b/tests/cloud/aws_password_policy_changes.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: cloudtrail.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail update_timestamp: true \ No newline at end of file From f6c78edc5d47dee591fec5692bcbff2044954ec6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Jan 2023 11:34:28 -0800 Subject: [PATCH 22/34] new mfa added aws --- ...aws_new_mfa_method_registered_for_user.yml | 70 +++++++++++++++++++ .../cloud/aws_password_policy_changes.yml | 7 +- ...ew_mfa_method_registered_for_user.test.yml | 13 ++++ 3 files changed, 86 insertions(+), 4 deletions(-) create mode 100644 detections/cloud/aws_new_mfa_method_registered_for_user.yml create mode 100644 tests/cloud/aws_new_mfa_method_registered_for_user.test.yml diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml new file mode 100644 index 0000000000..2ceb9734df --- /dev/null +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -0,0 +1,70 @@ +name: AWS New MFA Method Registered For User +id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b +version: 1 +date: '2023-01-31' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the registration of a new Multi Factor authentication method for an AAWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. +search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `aws_new_mfa_method_registered_for_user_filter`' +how_to_implement: how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This + search works when AWS CloudTrail logs. +known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://attack.mitre.org/techniques/T1556/ +- https://attack.mitre.org/techniques/T1556/006/ +- https://twitter.com/jhencinski/status/1618660062352007174 +tags: + analytic_story: + - Compromised User Account + - Azure Active Directory Account Takeover + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$ + mitre_attack_id: + - T1556 + - T1556.006 + nist: + - DE.CM + observable: + - name: user_name + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - src_ip + - eventName + - eventSource + - requestParameters.virtualMFADeviceName + - errorCode + - userIdentity.principalId + - userAgent + - awsRegion + - user_name + - userIdentity.arn + - _time + risk_score: 64 + security_domain: identity diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index 4f13317d3d..b780210215 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -4,10 +4,9 @@ version: 1 date: '2023-01-26' author: Bhavin Patel, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. -search: '`cloudtrail` eventName=*PasswordPolicy errorCode=success | stats count values(eventName) values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' +search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success | stats count values(eventName) as eventName values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible @@ -32,7 +31,7 @@ tags: impact: 90 kill_chain_phases: - Reconnaissance - message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ + message: User $user_arn$ is attempting to $eventName$ the password policy for account id $aws_account_id$ mitre_attack_id: - T1201 nist: diff --git a/tests/cloud/aws_new_mfa_method_registered_for_user.test.yml b/tests/cloud/aws_new_mfa_method_registered_for_user.test.yml new file mode 100644 index 0000000000..09472fe644 --- /dev/null +++ b/tests/cloud/aws_new_mfa_method_registered_for_user.test.yml @@ -0,0 +1,13 @@ +name: AWS New MFA Method Registered For User Unit Test +tests: +- name: AWS New MFA Method Registered For User + file: cloud/aws_new_mfa_method_registered_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From ae07e87dc1a6342e28f388cda724ba0bcb86c102 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Jan 2023 16:42:19 -0800 Subject: [PATCH 23/34] spl update --- .../cloud/aws_console_logins_from_multiple_ips.yml | 12 ++++-------- .../cloud/aws_new_mfa_method_registered_for_user.yml | 2 +- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index 8d5be295c7..b043a4eb1b 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -4,13 +4,9 @@ version: 1 date: '2023-01-19' author: Bhavin Patel, Splunk type: Anomaly -datamodel: -- Authentication +datamodel: [] description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 10 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime dc(Authentication.src) as distinct_ip_count values(Authentication.src) as src_ip values(Authentication.user_agent) as user_agent values(Authentication.action) as action from datamodel=Authentication - where Authentication.signature=ConsoleLogin by _time span=10m Authentication.user Authentication.user_type -| `drop_dm_object_name(Authentication)` -| where distinct_ip_count >= 2 | `aws_console_logins_from_multiple_ips_filter`' +search: ' `cloudtrail` eventName = ConsoleLogin | bin span=10m _time | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn | where distinct_ip_count>1 | `aws_console_logins_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail events are normalized use the Authentication datamodel. known_false_positives: It is highly unlikely to have two login attempts from entirely differnt IP addresses. @@ -34,7 +30,7 @@ tags: impact: 90 kill_chain_phases: - Actions on Objectives - message: User $user$ has successfully logged into the AWS Console from different IP addresses $src$ with 5 mins + message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 10 mins mitre_attack_id: - T1586 - T1535 @@ -64,4 +60,4 @@ tags: - Authentication.action - Authentication.user_type risk_score: 72 - security_domain: threat + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 2ceb9734df..1b71f76863 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -12,7 +12,7 @@ how_to_implement: how_to_implement: You must install Splunk AWS add on and Splun search works when AWS CloudTrail logs. known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. references: -- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ - https://attack.mitre.org/techniques/T1556/ - https://attack.mitre.org/techniques/T1556/006/ - https://twitter.com/jhencinski/status/1618660062352007174 From 1e9e0a1c5abec99b2f364a7e80198d9d2ea1a09a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Jan 2023 16:50:58 -0800 Subject: [PATCH 24/34] remove wrong file --- lookups/REFERENCE_CACHE.db.db | Bin 16384 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 lookups/REFERENCE_CACHE.db.db diff --git a/lookups/REFERENCE_CACHE.db.db b/lookups/REFERENCE_CACHE.db.db deleted file mode 100644 index 6558e5f59cd95c00adc7f97e6dcf68a70328ce6e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16384 zcmeIu!41MN5Cp&tL?{m)eCQ!r%d)PcZuT!SBIES>gjOFnCIxo=5M$-F1G z(&m~>C2D2qO}TFe=bmfHx~A9T`99kEMytLZ7fbu Date: Tue, 31 Jan 2023 17:02:34 -0800 Subject: [PATCH 25/34] fix yaml --- detections/cloud/aws_new_mfa_method_registered_for_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 1b71f76863..5e6185d2d6 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies the registration of a new Multi Factor authentication method for an AAWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_new_mfa_method_registered_for_user_filter`' -how_to_implement: how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs. known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. references: From 5dd64e3fd1ac610ee09fbcaa28a39a970c09f4f8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:01:28 -0800 Subject: [PATCH 26/34] aws concurrent detections --- ...concurrent_sessions_from_different_ips.yml | 66 +++++++++++++++++++ ...rrent_sessions_from_different_ips.test.yml | 13 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/cloud/aws_concurrent_sessions_from_different_ips.yml create mode 100644 tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml new file mode 100644 index 0000000000..0ca09d2ddb --- /dev/null +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,66 @@ +name: AWS Concurrent Sessions From Different Ips +id: 51c04fdb-2746-465a-b86e-b413a09c9085 +version: 1 +date: '2023-02-01' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely +search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" +| bin span=5m _time +| stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn +| where distinct_ip_count > 1 + | `aws_concurrent_sessions_from_different_ips_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. +references: +- https://attack.mitre.org/techniques/T1185/ +- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/ +- https://github.com/kgretzky/evilginx2 +tags: + analytic_story: + - Compromised User Account + - AWS Identity and Access Management Account + asset_type: AWS Accoun + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json + impact: 70 + kill_chain_phases: + - Exploitation + message: User $user_arn$ has concurrent sessions from more than one unique IP address $src_ip$ in the span of 5 minutes. + mitre_attack_id: + - T1185 + nist: + - DE.CM + observable: + - name: user_arn + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - user_arn + - aws_account_id + - src_ip + risk_score: 42 + security_domain: threat \ No newline at end of file diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml new file mode 100644 index 0000000000..4e2664b79b --- /dev/null +++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml @@ -0,0 +1,13 @@ +name: AWS Concurrent Sessions From Different Ips Unit Test +tests: +- name: AWS Concurrent Sessions From Different Ips + file: cloud/aws_concurrent_sessions_from_different_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 706b0842a307a3bec92e7f604636fa8b5fe39504 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:12:36 -0800 Subject: [PATCH 27/34] minor error test file --- tests/cloud/aws_console_logins_from_multiple_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml index 547ec29026..280d1b83b7 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -3,7 +3,7 @@ tests: - name: AWS Console Logins From Multiple IPs file: cloud/aws_console_logins_from_multiple_ips.yml pass_condition: '| stats count | where count > 0' - earliest_time: -7dh + earliest_time: -7d latest_time: now attack_data: - file_name: cloudtrail.json From 389d1e34aeebe6647e83b838a2b4d9478309a10c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:14:07 -0800 Subject: [PATCH 28/34] updating test filee --- tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml index 4e2664b79b..64f956ff88 100644 --- a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml +++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml @@ -10,4 +10,4 @@ tests: data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true + update_timestamp: true \ No newline at end of file From 7c88bf93c91b8672da2db3d37a1fa16b934531a7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:19:30 -0800 Subject: [PATCH 29/34] validation error --- .../cloud/aws_concurrent_sessions_from_different_ips.yml | 6 +++--- .../aws_concurrent_sessions_from_different_ips.test.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml index 0ca09d2ddb..a04f9576f9 100644 --- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -5,7 +5,7 @@ date: '2023-02-01' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely +description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely. search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" | bin span=5m _time | stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn @@ -22,7 +22,7 @@ tags: analytic_story: - Compromised User Account - AWS Identity and Access Management Account - asset_type: AWS Accoun + asset_type: AWS Account cis20: - CIS 3 - CIS 5 @@ -55,7 +55,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - _time - eventName - userAgent - errorCode diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml index 64f956ff88..72faec2903 100644 --- a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml +++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: cloudtrail.json - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail update_timestamp: true \ No newline at end of file From bc7fa3078f5deb6e8df10f500cf53f1f87ac3dcc Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 2 Feb 2023 18:38:06 -0500 Subject: [PATCH 30/34] multiple fixes --- ...ws_concurrent_sessions_from_different_ips.yml | 12 ++++++++---- ...number_of_failed_authentications_for_user.yml | 12 ++++++++---- ..._number_of_failed_authentications_from_ip.yml | 12 ++++++++---- .../aws_new_mfa_method_registered_for_user.yml | 7 +++++-- detections/cloud/aws_password_policy_changes.yml | 2 +- ...console_authentication_from_multiple_ips.yml} | 16 +++++++++++----- ..._number_of_failed_authentications_from_ip.yml | 4 ++-- ...essful_authentication_from_different_ips.yml} | 6 +++--- ...le_authentication_from_multiple_ips.test.yml} | 6 +++--- ...l_authentication_from_different_ips.test.yml} | 6 +++--- 10 files changed, 52 insertions(+), 31 deletions(-) rename detections/cloud/{aws_console_logins_from_multiple_ips.yml => aws_successful_console_authentication_from_multiple_ips.yml} (55%) rename detections/cloud/{azure_ad_succesful_authentication_from_different_ips.yml => azure_ad_successful_authentication_from_different_ips.yml} (91%) rename tests/cloud/{aws_console_logins_from_multiple_ips.test.yml => aws_successful_console_authentication_from_multiple_ips.test.yml} (65%) rename tests/cloud/{azure_ad_succesful_authentication_from_different_ips.test.yml => azure_ad_successful_authentication_from_different_ips.test.yml} (70%) diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml index a04f9576f9..4498ed8c1f 100644 --- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -5,11 +5,15 @@ date: '2023-02-01' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely. +description: The following analytic identifies an AWS IAM account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. + This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate + online resources. When a user navigates the AWS Console after authentication, the API call with the event name `DescribeEventAggregates` is registered in the AWS CloudTrail logs. The Splunk Threat Research team leveraged + this event name to identify 2 concurrent sessions. The presence of this event occurring from two different IP addresses is highly unlikely. + As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" -| bin span=5m _time -| stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn -| where distinct_ip_count > 1 + | bin span=5m _time + | stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn + | where distinct_ip_count > 1 | `aws_concurrent_sessions_from_different_ips_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml index 3e60fc1946..bd36953833 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -5,12 +5,16 @@ date: '2023-01-27' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies an AWS IAM User account with more than 20 failed authentication events in the span of 10 minutes. This behavior could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id | where failed_attempts > 20 | `aws_high_number_of_failed_authentications_for_user_filter`' +description: The following analytic identifies an AWS account with more than 20 failed authentication events in the span of 5 minutes. This behavior + could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. +search: '`cloudtrail` eventName=ConsoleLogin action=failure + | bucket span=10m _time + | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id + | where failed_attempts > 20 + | `aws_high_number_of_failed_authentications_for_user_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -known_false_positives: While this search has no known false positives, it is possible - that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. references: - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html tags: diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml index 6a257101c0..154d30a99b 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -5,11 +5,15 @@ date: '2023-01-30' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies an IP address which failing to authenticate 20 or more times to an AWS Web Console in the span of 10 minutes. This behavior - could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id | where failed_attempts > 20 |`aws_high_number_of_failed_authentications_from_ip_filter`' +description: The following analytic identifies an IP address failing to authenticate 20 or more times to the AWS Web Console in the span of 5 minutes. This behavior + could represent a brute force attack against an AWS tenant to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection. +search: '`cloudtrail` eventName=ConsoleLogin action=failure + | bucket span=5m _time + | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id + | where failed_attempts > 20 + | `aws_high_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. -known_false_positives: No known false postives for this detection. Please review this alert +known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. references: - https://attack.mitre.org/techniques/T1110/003/ - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 5e6185d2d6..9c2c9bcbc0 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -5,8 +5,11 @@ date: '2023-01-31' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: The following analytic identifies the registration of a new Multi Factor authentication method for an AAWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. -search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: The following analytic identifies the registration of a new Multi Factor authentication method for an AWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. +search: ' `cloudtrail` eventName=CreateVirtualMFADevice + | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_new_mfa_method_registered_for_user_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs. diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index b780210215..9ed4eee7b0 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -5,7 +5,7 @@ date: '2023-01-26' author: Bhavin Patel, Splunk type: Hunting datamodel: [] -description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. +description: This search looks for AWS CloudTrail events where a user is making successful API calls to view/update/delete the existing password policy in an AWS organization. It is unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success | stats count values(eventName) as eventName values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml similarity index 55% rename from detections/cloud/aws_console_logins_from_multiple_ips.yml rename to detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml index b043a4eb1b..c923a7f4ae 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml @@ -1,15 +1,21 @@ -name: AWS Console Logins From Multiple IPs +name: AWS Successful Console Authentication From Multiple IPs id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb version: 1 date: '2023-01-19' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 10 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. -search: ' `cloudtrail` eventName = ConsoleLogin | bin span=10m _time | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn | where distinct_ip_count>1 | `aws_console_logins_from_multiple_ips_filter`' +description: The following analytic identifies an AWS account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent + an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user. + As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. +search: ' `cloudtrail` eventName = ConsoleLogin + | bin span=5m _time + | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn + | where distinct_ip_count>1 + | `aws_successful_console_authentication_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail events are normalized use the Authentication datamodel. -known_false_positives: It is highly unlikely to have two login attempts from entirely differnt IP addresses. +known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. references: - https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/ tags: @@ -30,7 +36,7 @@ tags: impact: 90 kill_chain_phases: - Actions on Objectives - message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 10 mins + message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 5 mins mitre_attack_id: - T1586 - T1535 diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml index 4e170cd933..918b0dc752 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -5,8 +5,8 @@ date: '2023-01-23' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies an Ip address which failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior - could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. +description: The following analytic identifies an Ip address failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior + could represent a brute force attack againstan Azure AD to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection. search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false | rename properties.* as * | bucket span=5m _time diff --git a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml similarity index 91% rename from detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml rename to detections/cloud/azure_ad_successful_authentication_from_different_ips.yml index 55a1ab4bd8..22dc46ffe5 100644 --- a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml @@ -1,4 +1,4 @@ -name: Azure AD Succesful Authentication From Different Ips +name: Azure AD Successful Authentication From Different Ips id: be6d868d-33b6-4aaa-912e-724fb555b11a version: 1 date: '2023-01-24' @@ -13,7 +13,7 @@ search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=S | bucket span=5m _time | stats dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips > 1 - | `azure_ad_succesful_authentication_from_different_ips_filter`' + | `azure_ad_successful_authentication_from_different_ips_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. @@ -36,7 +36,7 @@ tags: - Source:Cloud Data - Stage:Initial Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log impact: 70 kill_chain_phases: - Exploitation diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml similarity index 65% rename from tests/cloud/aws_console_logins_from_multiple_ips.test.yml rename to tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml index 280d1b83b7..d408e012d2 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml @@ -1,7 +1,7 @@ -name: AWS Console Logins From Multiple IPs Unit Test +name: AWS Successful Console Authentication From Multiple IPs Unit Test tests: -- name: AWS Console Logins From Multiple IPs - file: cloud/aws_console_logins_from_multiple_ips.yml +- name: AWS Successful Console Authentication From Multiple IPs + file: cloud/aws_successful_console_authentication_from_multiple_ips.yml pass_condition: '| stats count | where count > 0' earliest_time: -7d latest_time: now diff --git a/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml similarity index 70% rename from tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml rename to tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml index 61fc50f54d..f8b7a85cfa 100644 --- a/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml +++ b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml @@ -1,13 +1,13 @@ -name: Azure AD Succesful Authentication From Different Ips Unit Test +name: Azure AD Successful Authentication From Different Ips Unit Test tests: -- name: Azure AD Succesful Authentication From Different Ips +- name: Azure AD Successful Authentication From Different Ips file: cloud/azure_ad_succesful_authentication_from_different_ips.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - file_name: azuread.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true From 5ae3a295a7154035fa935834047c0b4395ea8201 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 2 Feb 2023 19:09:32 -0500 Subject: [PATCH 31/34] fix typo --- ...ure_ad_successful_authentication_from_different_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml index f8b7a85cfa..04acd597bf 100644 --- a/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml +++ b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml @@ -1,7 +1,7 @@ name: Azure AD Successful Authentication From Different Ips Unit Test tests: - name: Azure AD Successful Authentication From Different Ips - file: cloud/azure_ad_succesful_authentication_from_different_ips.yml + file: cloud/azure_ad_successful_authentication_from_different_ips.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 192b93a110bf6e66c2c076e3cb66870020a343a4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Feb 2023 10:53:26 -0500 Subject: [PATCH 32/34] adding required field --- .../azure_ad_successful_authentication_from_different_ips.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml index 22dc46ffe5..25bf663c49 100644 --- a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml @@ -67,5 +67,6 @@ tags: - properties.authenticationDetails - properties.userPrincipalName - properties.ipAddress + - properties.appDisplayName risk_score: 56 security_domain: identity \ No newline at end of file From 621fe10dfd8b13ff56f035a628cfaaf4fbb7013f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Feb 2023 12:40:01 -0500 Subject: [PATCH 33/34] Delete test_config_bak.json --- .../test_config_bak.json | 123 ------------------ 1 file changed, 123 deletions(-) delete mode 100644 bin/docker_detection_tester/test_config_bak.json diff --git a/bin/docker_detection_tester/test_config_bak.json b/bin/docker_detection_tester/test_config_bak.json deleted file mode 100644 index e6e2354d16..0000000000 --- a/bin/docker_detection_tester/test_config_bak.json +++ /dev/null @@ -1,123 +0,0 @@ -{ - "apps": { - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - }, - "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { - "app_number": 3110, - "app_version": "4.5.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" - } - }, - "branch": "TR-2326_migrate_password_spraying_xml", - "commit_hash": null, - "container_tag": "latest", - "detections_list": [ - "security_content/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml", - "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml", - "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml", - "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml", - "security_content/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml", - "security_content/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml", - "security_content/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml", - "security_content/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml"], - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": true, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "selected", - "no_interactive_failure": false, - "num_containers": 1, - "persist_security_content": true, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} From 31413e3204fbd7f303d5ac19fb918839a053dcb0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 6 Feb 2023 15:48:16 -0800 Subject: [PATCH 34/34] Update compromised_user_account.yml --- stories/compromised_user_account.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index 74b5eea652..6124da49fe 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -9,7 +9,8 @@ references: - https://www.proofpoint.com/us/threat-reference/compromised-account tags: analytic_story: Compromised User Account - category: [] + category: + - Adversary Tactics product: - Splunk Enterprise - Splunk Enterprise Security