Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2021-06-25 19:51:23 +00:00
parent 33de9753a3 8ab5325de6
commit 6885dcaaa5
41 changed files with 68 additions and 68 deletions
@@ -5,7 +5,7 @@ date: '2021-02-22'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user created a policy
+description: This search looks for AWS CloudTrail events where a user created a policy
  version that allows them to access any resource in their account
 search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
  errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
@@ -16,7 +16,7 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.
  awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately created a policy to allow a user to access all
  resources. That said, AWS strongly advises against granting full control to all
@@ -5,7 +5,7 @@ date: '2021-03-02'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user A who has already
+description: This search looks for AWS CloudTrail events where a user A who has already
  permission to create access keys, makes an API call to create access keys for another
  user B. Attackers have been know to use this technique for Privilege Escalation
  in case new victim(user B) has more permissions than old victim(user B)
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.
  eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
  user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately created keys for another user.
 references:
@@ -5,7 +5,7 @@ date: '2021-03-02'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user A(victim A) creates
+description: This search looks for AWS CloudTrail events where a user A(victim A) creates
  a login profile for user B, followed by a AWS Console login event from user B from
  the same src_ip as user B. This correlated event can be indicative of privilege
  escalation since both events happened from the same src_ip
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.
  awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately created a login profile for another user.
 references:
@@ -19,7 +19,7 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
  eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
+  search works with AWS CloudTrail logs
 known_false_positives: unknown
 references:
 - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e
  values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
+  search works with AWS CloudTrail logs
 known_false_positives: bucket with S3 encryption
 references:
 - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
@@ -5,7 +5,7 @@ date: '2021-04-13'
 author: Patrick Bareiss, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events and analyse the amount of eventNames
+description: This search looks for AWS CloudTrail events and analyse the amount of eventNames
  which starts with Describe by a single user. This indicates that this user scans
  the configuration of your AWS cloud environment.
 search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*
  by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives.
 references:
 - https://github.com/aquasecurity/cloudsploit
@@ -5,7 +5,7 @@ date: '2021-01-11'
 author: Bhavin Patel, Patrick Bareiss, Splunk
 type: batch
 datamodel: []
-description: The search looks for CloudTrail events to detect if any network ACLs
+description: The search looks for AWS CloudTrail events to detect if any network ACLs
  were created with all the ports open to a specified CIDR.
 search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
  requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
  requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
+  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
  inputs.
 known_false_positives: It's possible that an admin has created this ACL with all ports
  open for some legitimate purpose however, this should be scoped and not allowed
@@ -9,13 +9,13 @@ description: Enforcing network-access controls is one of the defensive mechanism
  used by cloud administrators to restrict access to a cloud instance. After the attacker
  has gained control of the AWS console by compromising an admin account, they can
  delete a network ACL and gain access to the instance from anywhere. This search
-  will query the CloudTrail logs to detect users deleting network ACLs.
+  will query the AWS CloudTrail logs to detect users deleting network ACLs.
 search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
  userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs.
 known_false_positives: It's possible that a user has legitimately deleted a network
  ACL.
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as f
  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  |`aws_saml_access_by_provider_user_and_principal_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
+  search works with AWS CloudTrail logs
 known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
  are very difficult to detect as accessing cloud providers with these assertions
  looks exactly like normal access, however things such as source IP sourceIPAddress
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f
  userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  |`aws_saml_update_identity_provider_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: Updating a SAML provider or creating a new one may not necessarily
  be malicious however it needs to be closely monitored.
 references:
@@ -5,7 +5,7 @@ date: '2021-03-02'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user has set a default
+description: This search looks for AWS CloudTrail events where a user has set a default
  policy versions. Attackers have been know to use this technique for Privilege Escalation
  in case the previous versions of the policy had permissions to access more resources
  than the current version of the policy
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon
  errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately set a default policy to allow a user to access
  all resources. That said, AWS strongly advises against granting full control to
@@ -5,7 +5,7 @@ date: '2021-03-02'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user A who has already
+description: This search looks for AWS CloudTrail events where a user A who has already
  permission to update login profile, makes an API call to update login profile for
  another user B . Attackers have been know to use this technique for Privilege Escalation
  in case new victim(user B) has more permissions than old victim(user B)
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazona
  eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName
  user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
+  search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately created keys for another user.
 references:
@@ -6,7 +6,7 @@ author: Rico Valdez, Splunk
 type: batch
 datamodel:
 - Authentication
-description: This search looks for CloudTrail events wherein a console login event
+description: This search looks for AWS CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
  The alert is fired if the user has logged into the console for the first time within
@@ -21,8 +21,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
  - Update` hourly (or more frequently depending on how often you run the detection
  searches) to refresh the baselines.
 known_false_positives: When a legitimate new user logins for the first time, this
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 type: batch
 datamodel:
 - Authentication
-description: This search looks for CloudTrail events wherein a console login event
+description: This search looks for AWS CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
  The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
  - Update` hourly (or more frequently depending on how often you run the detection
  searches) to refresh the baselines. You can also provide additional filtering for
  this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 type: batch
 datamodel:
 - Authentication
-description: This search looks for CloudTrail events wherein a console login event
+description: This search looks for AWS CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
  The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
  - Update` hourly (or more frequently depending on how often you run the detection
  searches) to refresh the baselines. You can also provide additional filtering for
  this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 type: batch
 datamodel:
 - Authentication
-description: This search looks for CloudTrail events wherein a console login event
+description: This search looks for AWS CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
  The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
  - Update` hourly (or more frequently depending on how often you run the detection
  searches) to refresh the baselines. You can also provide additional filtering for
  this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Bhavin Patel, Patrick Bareiss, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user has created an open/public
+description: This search looks for AWS CloudTrail events where a user has created an open/public
  S3 bucket.
 search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
  "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Patrick Bareiss, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user has created an open/public
+description: This search looks for AWS CloudTrail events where a user has created an open/public
  S3 bucket over the aws cli.
 search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
  IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user successfully launches
+description: This search looks for AWS CloudTrail events where a user successfully launches
  an abnormally high number of instances. This search is deprecated and have been
  translated to use the latest Change Datamodel
 search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m _time
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m
  / total_launched_stdev, 2) | table _time, userName, instances_launched, num_standard_deviations_away,
  total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. The threshold value should be tuned to your environment.
 known_false_positives: Many service accounts configured within an AWS infrastructure
  are known to exhibit this behavior. Please adjust the threshold values and filter
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Jason Brewer, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user successfully launches
+description: This search looks for AWS CloudTrail events where a user successfully launches
  an abnormally high number of instances. This search is deprecated and have been
  translated to use the latest Change Datamodel.
 search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter`
@@ -13,7 +13,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_
  apply ec2_excessive_runinstances_v1  | rename "IsOutlier(instances_launched)" as
  isOutlier  | where isOutlier=1'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. The threshold value should be tuned to your environment.
 known_false_positives: Many service accounts configured within an AWS infrastructure
  are known to exhibit this behavior. Please adjust the threshold values and filter
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where an abnormally high number
+description: This search looks for AWS CloudTrail events where an abnormally high number
  of instances were successfully terminated by a user in a 10-minute window. This
  search is deprecated and have been translated to use the latest Change Datamodel.
 search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket span=10m
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp
  num_standard_deviations_away, total_terminations_avg, total_terminations_stdev |
  `abnormally_high_aws_instances_terminated_by_user_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs.
 known_false_positives: Many service accounts configured with your AWS infrastructure
  are known to exhibit this behavior. Please adjust the threshold values and filter
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Jason Brewer, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user successfully terminates
+description: This search looks for AWS CloudTrail events where a user successfully terminates
  an abnormally high number of instances. This search is deprecated and have been
  translated to use the latest Change Datamodel.
 search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter`
@@ -13,7 +13,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally
  apply ec2_excessive_terminateinstances_v1  | rename "IsOutlier(instances_terminated)"
  as isOutlier  | where isOutlier=1'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. The threshold value should be tuned to your environment.
 known_false_positives: Many service accounts configured within an AWS infrastructure
  are known to exhibit this behavior. Please adjust the threshold values and filter
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
  output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
  src_ip, City, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_city_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen AWS Provisioning
  Activity Sources" support search once to create a history of previously seen locations
  that have provisioned AWS resources.
@@ -21,7 +21,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
  spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time,
  user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen AWS Provisioning
  Activity Sources" support search once to create a history of previously seen locations
  that have provisioned AWS resources.
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail`
  | spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table
  _time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen AWS Provisioning
  Activity Sources" support search once to create a history of previously seen locations
  that have provisioned AWS resources.
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
  output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
  src_ip, Region, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_region_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen AWS Provisioning
  Activity Sources" support search once to create a history of previously seen locations
  that have provisioned AWS resources.
@@ -5,7 +5,7 @@ date: '2018-05-17'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where a user logged into the
+description: This search looks for AWS CloudTrail events where a user logged into the
  AWS account, is making API calls and has not enabled Multi Factor authentication.
  Multi factor authentication adds a layer of security by forcing the users to type
  a unique authentication code from an approved authentication device when they access
@@ -17,7 +17,7 @@ search: '`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa
  as eventName by userIdentity.arn userIdentity.type user | `security_content_ctime(firstTime)`  |
  `security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter`'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. Leverage the support search `Create a list of approved AWS service accounts`:
  run it once every 30 days to create a list of service accounts and validate them.\

@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for successful CloudTrail activity by user accounts
+description: This search looks for successful AWS CloudTrail activity by user accounts
  that are not listed in the identity table or `aws_service_accounts.csv`. It returns
  event names and count, as well as the first and last time a specific user or service
  is detected, grouped by users. Deprecated because managing this list can be quite
@@ -17,7 +17,7 @@ search: '`cloudtrail` errorCode=success | rename userName as identity | search N
  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_aws_api_activities_from_unapproved_accounts_filter`'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. You must also populate the `identity_lookup_expanded` lookup shipped with
  the Asset and Identity framework to be able to look up users in your identity table
  in Enterprise Security (ES). Leverage the support search called "Create a list of
@@ -18,9 +18,9 @@ search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=A
  as earliest latest(_time) as latest by user | `security_content_ctime(earliest)`
  | `security_content_ctime(latest)` | `detect_new_api_calls_from_user_roles_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously seen API call per user
-  roles in CloudTrail" support search once to create a history of previously seen
+  roles in AWS CloudTrail" support search once to create a history of previously seen
  user roles.
 known_false_positives: It is possible that there are legitimate user roles making
  new or infrequently used API calls in your infrastructure, causing the search to
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events wherein a console login event
+description: This search looks for AWS CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
  The alert is fired if the user has logged into the console for the first time within
@@ -17,10 +17,10 @@ search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user |
  "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
  where userStatus ="First Time Logging into AWS Console"  | `detect_new_user_aws_console_login_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Run the "Previously seen users in CloudTrail" support search only once to
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
+  inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to
  create a baseline of previously seen IAM users within the last 30 days. Run "Update
-  previously seen users in CloudTrail" hourly (or more frequently depending on how
+  previously seen users in AWS CloudTrail" hourly (or more frequently depending on how
  often you run the detection searches) to refresh the baselines.
 known_false_positives: When a legitimate new user logins for the first time, this
  activity will be detected. Check how old the account is and verify that the user
@@ -24,7 +24,7 @@ search: '`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi
  as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user
  | `detect_spike_in_aws_api_activity_filter`'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
  your environment. The `dataPointThreshold` variable is the minimum number of data
  points required to have a statistically significant amount of data to determine.
@@ -23,7 +23,7 @@ search: '`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_eve
  | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
  as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
  your environment. The `dataPointThreshold` variable is the minimum number of data
  points required to have a statistically significant amount of data to determine.
@@ -24,7 +24,7 @@ search: '`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_
  | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
  as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
  your environment. The `dataPointThreshold` variable is the minimum number of data
  points required to have a statistically significant amount of data to determine.
@@ -17,7 +17,7 @@ search: '`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod
  | rename arn as userIdentity.arn | table userIdentity.arn] | spath output=dest responseElements.instancesSet.items{}.instanceId
  | spath output=user userIdentity.arn | table _time, user, dest | `ec2_instance_modified_with_previously_unseen_user_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen EC2 Launches By
  User" support search once to create a history of previously seen ARNs. To add or
  remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
@@ -5,7 +5,7 @@ date: '2018-02-23'
 author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
-description: This search looks for CloudTrail events where an instance is started
+description: This search looks for AWS CloudTrail events where an instance is started
  in a particular region in the last one hour and then compares it to a lookup file
  of previously seen regions where an instance was started
 search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as earliest
@@ -16,7 +16,7 @@ search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as ear
  | `security_content_ctime(latest)` | where regionStatus="Instance Started in a New
  Region" | `ec2_instance_started_in_previously_unseen_region_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. Run the "Previously seen AWS Regions" support search only once to create
  of baseline of previously seen regions.  This search is deprecated and have been
  translated to use the latest Change Datamodel.
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
  as arn, requestParameters.instancesSet.items{}.imageId as amiID | table firstTime,
  lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen EC2 AMIs" support
  search once to create a history of previously seen AMIs.
 known_false_positives: After a new AMI is created, the first systems created with
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
  as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table
  _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen EC2 Instance Types"
  support search once to create a history of previously seen instance types.
 known_false_positives: It is possible that an admin will create a new system using
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
  as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
  as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. This search works best when you run the "Previously Seen EC2 Launches By
  User" support search once to create a history of previously seen ARNs.
 known_false_positives: It's possible that a user will start to create EC2 instances
@@ -13,7 +13,7 @@ search: '`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionI
  requestParameters.roleName responseElements.role.roleName responseElements.role.createDate
  | `aws_detect_sts_assume_role_abuse_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
+  search works with AWS CloudTrail logs
 known_false_positives: Sts:AssumeRole can be very noisy as it is a standard mechanism
  to provide cross account and cross resources access. This search can be adjusted
  to provide specific values to identify cases of abuse.
@@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=Dele
  path=requestParameters.bucketName | stats values(bucketName) as bucketName, count
  as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_s3_bucket_deletion_filter`'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
  your environment. The `dataPointThreshold` variable is the minimum number of data
  points required to have a statistically significant amount of data to determine.
@@ -14,7 +14,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime FROM data
  Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")`
  | `new_container_uploaded_to_aws_ecr_filter` '
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
  inputs. You must also install Cloud Infrastructure data model. Please also customize
  the `container_implant_aws_detection_filter` macro to filter out the false positives.
 known_false_positives: Uploading container is a normal behavior from developers or