From 69a1c028bf44294671e482c4dd625aa09a7c3bda Mon Sep 17 00:00:00 2001 From: root Date: Tue, 1 Dec 2020 20:38:45 +0000 Subject: [PATCH] Added detection testing service results inCloud Provisioning Activity From Previously Unseen Country --- ...sioning_from_previously_unseen_country.yml | 44 ++++++++++--------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index de0b164fec..19b65861ea 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -2,30 +2,30 @@ name: Cloud Provisioning Activity From Previously Unseen Country id: 94994255-3acf-4213-9b3f-0494df03bb31 version: 1 date: '2020-10-09' -description: 'This search looks for cloud provisioning activities from previously unseen +description: This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or - creates something.' -how_to_implement: You must be ingesting your cloud infrastructure logs from your - cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` - to build the initial table of source IP address, geographic locations, and times. You must also enable the second - baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and - to age out old data. You can adjust the time window for this search by updating the - `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by - customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro. + creates something. +how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud + provider. You should run the baseline search `Previously Seen Cloud Provisioning + Activity Sources - Initial` to build the initial table of source IP address, geographic + locations, and times. You must also enable the second baseline search `Previously + Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date + and to age out old data. You can adjust the time window for this search by updating + the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide + additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` + macro. type: ESCU references: [] author: Rico Valdez, Bhavin Patel, Splunk -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change - where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success - by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` - | iplocation src | where isnotnull(Country) - | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data - | eventstats max(enough_data) as enough_data - | where enough_data=1 - | eval firstTimeSeenCountry=min(firstTimeSeen) - | where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h") - | table firstTime, src, Country, user, object, command - | `cloud_provisioning_activity_from_previously_unseen_country_filter` +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | + `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) + | lookup previously_seen_cloud_provisioning_activity_sources Country as Country + OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | + where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry) + OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src, + Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter` | `security_content_ctime(firstTime)`' known_false_positives: "This is a strictly behavioral search, so we define \"false\ \ positive\" slightly differently. Every time this fires, it will accurately reflect\ @@ -52,4 +52,6 @@ tags: risk_score: 5 risk_object_type: user risk_object: user - + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json