From 45c138d518ca809ed9221d0fe28412f6ab39c686 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 25 Jun 2021 14:44:02 -0400 Subject: [PATCH 1/5] updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming --- .../aws_create_policy_version_to_allow_all_resources.yml | 2 +- detections/cloud/aws_createaccesskey.yml | 2 +- detections/cloud/aws_createloginprofile.yml | 2 +- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 2 +- detections/cloud/aws_iam_assume_role_policy_brute_force.yml | 4 ++-- detections/cloud/aws_iam_delete_policy.yml | 4 ++-- detections/cloud/aws_iam_failure_group_deletion.yml | 4 ++-- detections/cloud/aws_iam_successful_group_deletion.yml | 4 ++-- detections/cloud/aws_setdefaultpolicyversion.yml | 2 +- detections/cloud/aws_updateloginprofile.yml | 2 +- .../detect_spike_in_aws_security_hub_alerts_for_user.yml | 2 +- 11 files changed, 15 insertions(+), 15 deletions(-) diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 046e58d6bf..6959fb4777 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -26,7 +26,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 9b287b1b03..20746e7024 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -23,7 +23,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index ab5045322f..2c48248cf6 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -25,7 +25,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index ef96015f78..7190e535e8 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -1,4 +1,4 @@ -name: AWS IAM AccessDenied Discovery Events +name: AWS Identity Access Manager (IAM) AccessDenied Discovery Events id: 3e1f1568-9633-11eb-a69c-acde48001122 version: 1 date: '2021-04-05' diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 8dbe65bb13..6f313ee8ab 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -1,4 +1,4 @@ -name: AWS IAM Assume Role Policy Brute Force +name: AWS Identity Access Manager (IAM) Assume Role Policy Brute Force id: f19e09b0-9308-11eb-b7ec-acde48001122 version: 1 date: '2021-04-01' @@ -29,7 +29,7 @@ references: - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index b049e0f898..871896f99b 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -1,4 +1,4 @@ -name: AWS IAM Delete Policy +name: AWS Identity Access Manager (IAM) Delete Policy id: ec3a9362-92fe-11eb-99d0-acde48001122 version: 1 date: '2021-04-01' @@ -27,7 +27,7 @@ references: - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 0315b7eb6b..875e58f24d 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -1,4 +1,4 @@ -name: AWS IAM Failure Group Deletion +name: AWS Identity Access Manager (IAM) Failure Group Deletion id: 723b861a-92eb-11eb-93b8-acde48001122 version: 1 date: '2021-04-01' @@ -27,7 +27,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 997d2d01d5..a36c557410 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -1,4 +1,4 @@ -name: AWS IAM Successful Group Deletion +name: AWS Identity Access Manager (IAM) Successful Group Deletion id: e776d06c-9267-11eb-819b-acde48001122 version: 1 date: '2021-03-31' @@ -25,7 +25,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 81f4fe04a5..10b9ada95c 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -25,7 +25,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 48ce03108b..d68f6e8539 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -23,7 +23,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS IAM Privilege Escalation + - AWS Identity Access Manager (IAM) Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index 9b2b3d0f36..1af5f04a20 100644 --- a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: batch datamodel: [] description: This search looks for a spike in number of of AWS security Hub alerts - for an AWS IAM User in 4 hours intervals. + for an AWS Identity Access Manager (IAM) User in 4 hours intervals. search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time | stats count AS alerts by _time user | eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev From f262360d0a9e50f59d3c7992b8fba3f54a96bf01 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 25 Jun 2021 14:50:50 -0400 Subject: [PATCH 2/5] updated CloudTrails to AWS CloudTrails --- .../aws_create_policy_version_to_allow_all_resources.yml | 4 ++-- detections/cloud/aws_createaccesskey.yml | 4 ++-- detections/cloud/aws_createloginprofile.yml | 4 ++-- ...sers_creating_keys_with_encrypt_policy_without_mfa.yml | 2 +- ...etect_users_with_kms_keys_performing_encryption_s3.yml | 2 +- detections/cloud/aws_excessive_security_scanning.yml | 4 ++-- ...rk_access_control_list_created_with_all_open_ports.yml | 4 ++-- .../cloud/aws_network_access_control_list_deleted.yml | 4 ++-- .../aws_saml_access_by_provider_user_and_principal.yml | 2 +- detections/cloud/aws_saml_update_identity_provider.yml | 2 +- detections/cloud/aws_setdefaultpolicyversion.yml | 4 ++-- detections/cloud/aws_updateloginprofile.yml | 4 ++-- detections/cloud/detect_aws_console_login_by_new_user.yml | 6 +++--- .../detect_aws_console_login_by_user_from_new_city.yml | 6 +++--- .../detect_aws_console_login_by_user_from_new_country.yml | 6 +++--- .../detect_aws_console_login_by_user_from_new_region.yml | 6 +++--- detections/cloud/detect_new_open_s3_buckets.yml | 2 +- .../cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- .../abnormally_high_aws_instances_launched_by_user.yml | 4 ++-- ...ormally_high_aws_instances_launched_by_user___mltk.yml | 4 ++-- .../abnormally_high_aws_instances_terminated_by_user.yml | 4 ++-- ...mally_high_aws_instances_terminated_by_user___mltk.yml | 4 ++-- ...aws_cloud_provisioning_from_previously_unseen_city.yml | 2 +- ..._cloud_provisioning_from_previously_unseen_country.yml | 2 +- ...oud_provisioning_from_previously_unseen_ip_address.yml | 2 +- ...s_cloud_provisioning_from_previously_unseen_region.yml | 2 +- .../detect_api_activity_from_users_without_mfa.yml | 4 ++-- ...detect_aws_api_activities_from_unapproved_accounts.yml | 4 ++-- .../deprecated/detect_new_api_calls_from_user_roles.yml | 4 ++-- .../deprecated/detect_new_user_aws_console_login.yml | 8 ++++---- .../deprecated/detect_spike_in_aws_api_activity.yml | 2 +- .../deprecated/detect_spike_in_network_acl_activity.yml | 2 +- .../detect_spike_in_security_group_activity.yml | 2 +- .../ec2_instance_modified_with_previously_unseen_user.yml | 2 +- .../ec2_instance_started_in_previously_unseen_region.yml | 4 ++-- .../ec2_instance_started_with_previously_unseen_ami.yml | 2 +- ...tance_started_with_previously_unseen_instance_type.yml | 2 +- .../ec2_instance_started_with_previously_unseen_user.yml | 2 +- .../cloud/aws_detect_sts_assume_role_abuse.yml | 2 +- .../cloud/detect_spike_in_s3_bucket_deletion.yml | 2 +- .../cloud/new_container_uploaded_to_aws_ecr.yml | 2 +- 41 files changed, 68 insertions(+), 68 deletions(-) diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 6959fb4777..83617c7036 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -5,7 +5,7 @@ date: '2021-02-22' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user created a policy +description: This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements @@ -16,7 +16,7 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws. awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 20746e7024..432824366a 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user A who has already +description: This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) @@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws. eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. references: diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index 2c48248cf6..41e17347f6 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user A(victim A) creates +description: This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip @@ -17,7 +17,7 @@ search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters. awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. references: diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index 1317a589e7..15bbbe1780 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -19,7 +19,7 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs + search works with AWS CloudTrail logs known_false_positives: unknown references: - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/ diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 90ba2951eb..64a6ca1645 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs + search works with AWS CloudTrail logs known_false_positives: bucket with S3 encryption references: - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/ diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 1a9ccb38e5..1ff6a55b20 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -5,7 +5,7 @@ date: '2021-04-13' author: Patrick Bareiss, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events and analyse the amount of eventNames +description: This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* | @@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives. references: - https://github.com/aquasecurity/cloudsploit diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index f2969bf48a..fac75be690 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -5,7 +5,7 @@ date: '2021-01-11' author: Bhavin Patel, Patrick Bareiss, Splunk type: batch datamodel: [] -description: The search looks for CloudTrail events to detect if any network ACLs +description: The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 @@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail + and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. known_false_positives: It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index c9eb4fcbbc..e501a12a81 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -9,13 +9,13 @@ description: Enforcing network-access controls is one of the defensive mechanism used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search - will query the CloudTrail logs to detect users deleting network ACLs. + will query the AWS CloudTrail logs to detect users deleting network ACLs. search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. known_false_positives: It's possible that a user has legitimately deleted a network ACL. diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index a9805a8494..d36e80c230 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as f userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_access_by_provider_user_and_principal_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs + search works with AWS CloudTrail logs known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index b612fb0986..c0b1029495 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. references: diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 10b9ada95c..8cbebe6e46 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user has set a default +description: This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy @@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index d68f6e8539..4609e4f568 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user A who has already +description: This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) @@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazona eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs. + search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. references: diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 22b17e8a28..f983c9e690 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -6,7 +6,7 @@ author: Rico Valdez, Splunk type: batch datamodel: - Authentication -description: This search looks for CloudTrail events wherein a console login event +description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within @@ -21,8 +21,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. known_false_positives: When a legitimate new user logins for the first time, this diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index bb25888484..4d97c2485f 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: batch datamodel: - Authentication -description: This search looks for CloudTrail events wherein a console login event +description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within @@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index fd6b5eb1b2..8aa8cc5f65 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: batch datamodel: - Authentication -description: This search looks for CloudTrail events wherein a console login event +description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within @@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index a87c40ec8d..e638c488d5 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: batch datamodel: - Authentication -description: This search looks for CloudTrail events wherein a console login event +description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within @@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index acf9405483..d4a3534ada 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Bhavin Patel, Patrick Bareiss, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user has created an open/public +description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index db34ceed1f..b3c9baa886 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Patrick Bareiss, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user has created an open/public +description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml index a44431f914..acce503890 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user successfully launches +description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m _time @@ -17,7 +17,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m / total_launched_stdev, 2) | table _time, userName, instances_launched, num_standard_deviations_away, total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. known_false_positives: Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml index 973b6ebad2..7eb4df52a8 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Jason Brewer, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user successfully launches +description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter` @@ -13,7 +13,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_ apply ec2_excessive_runinstances_v1 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. known_false_positives: Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml index 4f88ebd63b..9207e45038 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where an abnormally high number +description: This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket span=10m @@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp num_standard_deviations_away, total_terminations_avg, total_terminations_stdev | `abnormally_high_aws_instances_terminated_by_user_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. known_false_positives: Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml index 1e39f9d453..165d25922b 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Jason Brewer, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user successfully terminates +description: This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter` @@ -13,7 +13,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally apply ec2_excessive_terminateinstances_v1 | rename "IsOutlier(instances_terminated)" as isOutlier | where isOutlier=1' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. known_false_positives: Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml index 2118ac34bf..da60e7a8f9 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, City, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_city_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml index 31db418f11..91cd741631 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -21,7 +21,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index 406eb9da21..6b29901b6a 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` | spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml index d941969ac2..ddcf57b400 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, Region, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_region_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml index cd95f9a83d..e28002568e 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml @@ -5,7 +5,7 @@ date: '2018-05-17' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where a user logged into the +description: This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access @@ -17,7 +17,7 @@ search: '`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa as eventName by userIdentity.arn userIdentity.type user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter`' how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\ diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml index 3a59991581..50bfde6320 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for successful CloudTrail activity by user accounts +description: This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite @@ -17,7 +17,7 @@ search: '`cloudtrail` errorCode=success | rename userName as identity | search N user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_aws_api_activities_from_unapproved_accounts_filter`' how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of diff --git a/detections/deprecated/detect_new_api_calls_from_user_roles.yml b/detections/deprecated/detect_new_api_calls_from_user_roles.yml index c8a4bd7227..51a9183400 100644 --- a/detections/deprecated/detect_new_api_calls_from_user_roles.yml +++ b/detections/deprecated/detect_new_api_calls_from_user_roles.yml @@ -18,9 +18,9 @@ search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=A as earliest latest(_time) as latest by user | `security_content_ctime(earliest)` | `security_content_ctime(latest)` | `detect_new_api_calls_from_user_roles_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously seen API call per user - roles in CloudTrail" support search once to create a history of previously seen + roles in AWS CloudTrail" support search once to create a history of previously seen user roles. known_false_positives: It is possible that there are legitimate user roles making new or infrequently used API calls in your infrastructure, causing the search to diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index 0de1dbc9be..7545c060ad 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events wherein a console login event +description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within @@ -17,10 +17,10 @@ search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the "Previously seen users in CloudTrail" support search only once to + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail + inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update - previously seen users in CloudTrail" hourly (or more frequently depending on how + previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. known_false_positives: When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user diff --git a/detections/deprecated/detect_spike_in_aws_api_activity.yml b/detections/deprecated/detect_spike_in_aws_api_activity.yml index 572e1e230d..a6c5e31f83 100644 --- a/detections/deprecated/detect_spike_in_aws_api_activity.yml +++ b/detections/deprecated/detect_spike_in_aws_api_activity.yml @@ -24,7 +24,7 @@ search: '`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_aws_api_activity_filter`' how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. diff --git a/detections/deprecated/detect_spike_in_network_acl_activity.yml b/detections/deprecated/detect_spike_in_network_acl_activity.yml index 4d19b4af1b..d7ab4fb083 100644 --- a/detections/deprecated/detect_spike_in_network_acl_activity.yml +++ b/detections/deprecated/detect_spike_in_network_acl_activity.yml @@ -23,7 +23,7 @@ search: '`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_eve | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. diff --git a/detections/deprecated/detect_spike_in_security_group_activity.yml b/detections/deprecated/detect_spike_in_security_group_activity.yml index 503b9bc21c..4efcbf25a3 100644 --- a/detections/deprecated/detect_spike_in_security_group_activity.yml +++ b/detections/deprecated/detect_spike_in_security_group_activity.yml @@ -24,7 +24,7 @@ search: '`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_ | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. diff --git a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml index ee2c7b47b4..3bb966ac49 100644 --- a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml @@ -17,7 +17,7 @@ search: '`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod | rename arn as userIdentity.arn | table userIdentity.arn] | spath output=dest responseElements.instancesSet.items{}.instanceId | spath output=user userIdentity.arn | table _time, user, dest | `ec2_instance_modified_with_previously_unseen_user_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. diff --git a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml index 10a4686f8c..7b924d861b 100644 --- a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml +++ b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml @@ -5,7 +5,7 @@ date: '2018-02-23' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for CloudTrail events where an instance is started +description: This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as earliest @@ -16,7 +16,7 @@ search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as ear | `security_content_ctime(latest)` | where regionStatus="Instance Started in a New Region" | `ec2_instance_started_in_previously_unseen_region_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml index c9fa5990db..31a281497d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml @@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI as arn, requestParameters.instancesSet.items{}.imageId as amiID | table firstTime, lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. known_false_positives: After a new AMI is created, the first systems created with diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml index a9c9e06fbe..68cb14a398 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. known_false_positives: It is possible that an admin will create a new system using diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml index 68af827e53..782a7f3b7a 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml @@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. known_false_positives: It's possible that a user will start to create EC2 instances diff --git a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml index 900f611b9d..930e970030 100644 --- a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml +++ b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml @@ -13,7 +13,7 @@ search: '`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionI requestParameters.roleName responseElements.role.roleName responseElements.role.createDate | `aws_detect_sts_assume_role_abuse_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudtrail logs + search works with AWS CloudTrail logs known_false_positives: Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse. diff --git a/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml index 905e4f1fc9..35ee75079d 100644 --- a/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml +++ b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml @@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=Dele path=requestParameters.bucketName | stats values(bucketName) as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_s3_bucket_deletion_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. diff --git a/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml index c1be25bc4f..5209986e3a 100644 --- a/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml +++ b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml @@ -14,7 +14,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime FROM data Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")` | `new_container_uploaded_to_aws_ecr_filter` ' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. known_false_positives: Uploading container is a normal behavior from developers or From b05af9f100e90c76fc10a2e48ff45ad1b7516cbe Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 25 Jun 2021 14:52:58 -0400 Subject: [PATCH 3/5] changing O365 to Office 365 --- detections/cloud/o365_add_app_role_assignment_grant_user.yml | 2 +- detections/cloud/o365_added_service_principal.yml | 2 +- detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 2 +- detections/cloud/o365_disable_mfa.yml | 2 +- .../cloud/o365_excessive_authentication_failures_alert.yml | 2 +- detections/cloud/o365_excessive_sso_logon_errors.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 2 +- detections/cloud/o365_pst_export_alert.yml | 2 +- detections/cloud/o365_suspicious_admin_email_forwarding.yml | 2 +- detections/cloud/o365_suspicious_rights_delegation.yml | 2 +- detections/cloud/o365_suspicious_user_email_forwarding.yml | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index efc41e965e..2b5126f1cd 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -1,4 +1,4 @@ -name: O365 Add App Role Assignment Grant User +name: Office 365 Add App Role Assignment Grant User id: b2c81cc6-6040-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 0fe3f211bc..4c38e491df 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,4 +1,4 @@ -name: O365 Added Service Principal +name: Office 365 Added Service Principal id: 1668812a-6047-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index bb5677d7e1..a9d04ce506 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -1,4 +1,4 @@ -name: O365 Bypass MFA via Trusted IP +name: Office 365 Bypass MFA via Trusted IP id: c783dd98-c703-4252-9e8a-f19d9f66949e version: 1 date: '2021-01-12' diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index a219fe3e1f..c1995ec0b5 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -1,4 +1,4 @@ -name: O365 Disable MFA +name: Office 365 Disable MFA id: c783dd98-c703-4252-9e8a-f19d9f5c949e version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 8733d5e50f..c504f89b36 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -1,4 +1,4 @@ -name: O365 Excessive Authentication Failures Alert +name: Office 365 Excessive Authentication Failures Alert id: d441364c-349c-453b-b55f-12eccab67cf9 version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 5dba881c26..d19a7657c8 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -1,4 +1,4 @@ -name: O365 Excessive SSO logon errors +name: Office 365 Excessive SSO logon errors id: 8158ccc4-6038-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 6a6b4e0d8b..057828d348 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -1,4 +1,4 @@ -name: O365 New Federated Domain Added +name: Office 365 New Federated Domain Added id: e155876a-6048-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 1f260b8963..9b1099aa4f 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -1,4 +1,4 @@ -name: O365 PST export alert +name: Office 365 PST export alert id: 5f694cc4-a678-4a60-9410-bffca1b647dc version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 9a5d5b3ea6..4853b9a6f5 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -1,4 +1,4 @@ -name: O365 Suspicious Admin Email Forwarding +name: Office 365 Suspicious Admin Email Forwarding id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 78cd3628d2..811b205a5b 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -1,4 +1,4 @@ -name: O365 Suspicious Rights Delegation +name: Office 365 Suspicious Rights Delegation id: b25d2973-303e-47c8-bacd-52b61604c6a7 version: 1 date: '2020-12-15' diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 698a76fd93..3df4f81b69 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -1,4 +1,4 @@ -name: O365 Suspicious User Email Forwarding +name: Office 365 Suspicious User Email Forwarding id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 version: 1 date: '2020-12-16' From 022c5be43e7ef54e530d5aad84c361ac01d35a81 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 25 Jun 2021 15:03:55 -0400 Subject: [PATCH 4/5] Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming" This reverts commit 45c138d518ca809ed9221d0fe28412f6ab39c686. --- .../aws_create_policy_version_to_allow_all_resources.yml | 2 +- detections/cloud/aws_createaccesskey.yml | 2 +- detections/cloud/aws_createloginprofile.yml | 2 +- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 2 +- detections/cloud/aws_iam_assume_role_policy_brute_force.yml | 4 ++-- detections/cloud/aws_iam_delete_policy.yml | 4 ++-- detections/cloud/aws_iam_failure_group_deletion.yml | 4 ++-- detections/cloud/aws_iam_successful_group_deletion.yml | 4 ++-- detections/cloud/aws_setdefaultpolicyversion.yml | 2 +- detections/cloud/aws_updateloginprofile.yml | 2 +- .../detect_spike_in_aws_security_hub_alerts_for_user.yml | 2 +- 11 files changed, 15 insertions(+), 15 deletions(-) diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 83617c7036..2855f4e2c6 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -26,7 +26,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 432824366a..b1cc9534a6 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -23,7 +23,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index 41e17347f6..2c9660e2b3 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -25,7 +25,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 7190e535e8..ef96015f78 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -1,4 +1,4 @@ -name: AWS Identity Access Manager (IAM) AccessDenied Discovery Events +name: AWS IAM AccessDenied Discovery Events id: 3e1f1568-9633-11eb-a69c-acde48001122 version: 1 date: '2021-04-05' diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 6f313ee8ab..8dbe65bb13 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -1,4 +1,4 @@ -name: AWS Identity Access Manager (IAM) Assume Role Policy Brute Force +name: AWS IAM Assume Role Policy Brute Force id: f19e09b0-9308-11eb-b7ec-acde48001122 version: 1 date: '2021-04-01' @@ -29,7 +29,7 @@ references: - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 871896f99b..b049e0f898 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -1,4 +1,4 @@ -name: AWS Identity Access Manager (IAM) Delete Policy +name: AWS IAM Delete Policy id: ec3a9362-92fe-11eb-99d0-acde48001122 version: 1 date: '2021-04-01' @@ -27,7 +27,7 @@ references: - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 875e58f24d..0315b7eb6b 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -1,4 +1,4 @@ -name: AWS Identity Access Manager (IAM) Failure Group Deletion +name: AWS IAM Failure Group Deletion id: 723b861a-92eb-11eb-93b8-acde48001122 version: 1 date: '2021-04-01' @@ -27,7 +27,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index a36c557410..997d2d01d5 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -1,4 +1,4 @@ -name: AWS Identity Access Manager (IAM) Successful Group Deletion +name: AWS IAM Successful Group Deletion id: e776d06c-9267-11eb-819b-acde48001122 version: 1 date: '2021-03-31' @@ -25,7 +25,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 8cbebe6e46..cdc3934bcd 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -25,7 +25,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 4609e4f568..a5094ff24c 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -23,7 +23,7 @@ references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ tags: analytic_story: - - AWS Identity Access Manager (IAM) Privilege Escalation + - AWS IAM Privilege Escalation asset_type: AWS Account automated_detection_testing: passed cis20: diff --git a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index 1af5f04a20..9b2b3d0f36 100644 --- a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: batch datamodel: [] description: This search looks for a spike in number of of AWS security Hub alerts - for an AWS Identity Access Manager (IAM) User in 4 hours intervals. + for an AWS IAM User in 4 hours intervals. search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time | stats count AS alerts by _time user | eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev From 30b6ec1eed95f5e1fd2ecbafda653d39fc4a7669 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 25 Jun 2021 15:05:19 -0400 Subject: [PATCH 5/5] Revert "changing O365 to Office 365" This reverts commit b05af9f100e90c76fc10a2e48ff45ad1b7516cbe. --- detections/cloud/o365_add_app_role_assignment_grant_user.yml | 2 +- detections/cloud/o365_added_service_principal.yml | 2 +- detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 2 +- detections/cloud/o365_disable_mfa.yml | 2 +- .../cloud/o365_excessive_authentication_failures_alert.yml | 2 +- detections/cloud/o365_excessive_sso_logon_errors.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 2 +- detections/cloud/o365_pst_export_alert.yml | 2 +- detections/cloud/o365_suspicious_admin_email_forwarding.yml | 2 +- detections/cloud/o365_suspicious_rights_delegation.yml | 2 +- detections/cloud/o365_suspicious_user_email_forwarding.yml | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 2b5126f1cd..efc41e965e 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -1,4 +1,4 @@ -name: Office 365 Add App Role Assignment Grant User +name: O365 Add App Role Assignment Grant User id: b2c81cc6-6040-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 4c38e491df..0fe3f211bc 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,4 +1,4 @@ -name: Office 365 Added Service Principal +name: O365 Added Service Principal id: 1668812a-6047-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index a9d04ce506..bb5677d7e1 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -1,4 +1,4 @@ -name: Office 365 Bypass MFA via Trusted IP +name: O365 Bypass MFA via Trusted IP id: c783dd98-c703-4252-9e8a-f19d9f66949e version: 1 date: '2021-01-12' diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index c1995ec0b5..a219fe3e1f 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -1,4 +1,4 @@ -name: Office 365 Disable MFA +name: O365 Disable MFA id: c783dd98-c703-4252-9e8a-f19d9f5c949e version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index c504f89b36..8733d5e50f 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -1,4 +1,4 @@ -name: Office 365 Excessive Authentication Failures Alert +name: O365 Excessive Authentication Failures Alert id: d441364c-349c-453b-b55f-12eccab67cf9 version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index d19a7657c8..5dba881c26 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -1,4 +1,4 @@ -name: Office 365 Excessive SSO logon errors +name: O365 Excessive SSO logon errors id: 8158ccc4-6038-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 057828d348..6a6b4e0d8b 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -1,4 +1,4 @@ -name: Office 365 New Federated Domain Added +name: O365 New Federated Domain Added id: e155876a-6048-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 9b1099aa4f..1f260b8963 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -1,4 +1,4 @@ -name: Office 365 PST export alert +name: O365 PST export alert id: 5f694cc4-a678-4a60-9410-bffca1b647dc version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 4853b9a6f5..9a5d5b3ea6 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -1,4 +1,4 @@ -name: Office 365 Suspicious Admin Email Forwarding +name: O365 Suspicious Admin Email Forwarding id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 version: 1 date: '2020-12-16' diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 811b205a5b..78cd3628d2 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -1,4 +1,4 @@ -name: Office 365 Suspicious Rights Delegation +name: O365 Suspicious Rights Delegation id: b25d2973-303e-47c8-bacd-52b61604c6a7 version: 1 date: '2020-12-15' diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 3df4f81b69..698a76fd93 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -1,4 +1,4 @@ -name: Office 365 Suspicious User Email Forwarding +name: O365 Suspicious User Email Forwarding id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 version: 1 date: '2020-12-16'