diff --git a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml new file mode 100644 index 0000000000..02ccb02b05 --- /dev/null +++ b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml @@ -0,0 +1,69 @@ +name: AWS AMI Atttribute Modification for Exfiltration +id: f2132d74-cf81-4c5e-8799-ab069e67dc9f +version: 2 +date: '2023-03-31' +author: BHavin Patel, Splunk +status: production +type: TTP +data_source: [] +description: This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs. +search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) +| rename requestParameters.launchPermission.add.items{}.group as group_added +| rename requestParameters.launchPermission.add.items{}.userId as accounts_added + | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public") | stats + count min(_time) as firstTime max(_time) as lastTime values(group_added) values(accounts_added) as accounts_added values(ami_status) by src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId +| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_atttribute_modification_for_exfiltration_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: It is possible that an AWS admin has legitimately shared a + snapshot with others for a specific purpose. +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ami/ +- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ +tags: + analytic_story: + - Suspicious Cloud Instance Activities + - Data Exfiltration + asset_type: EC2 Snapshot + confidence: 80 + impact: 100 + message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$ or AMI made is made Public. + mitre_attack_id: + - T1537 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - requestParameters.attributeType + - aws_account_id + - vendor_region + - user_agent + - userIdentity.principalId + risk_score: 80 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml new file mode 100644 index 0000000000..f173606b91 --- /dev/null +++ b/detections/cloud/aws_disable_bucket_versioning.yml @@ -0,0 +1,62 @@ +name: AWS Disable Bucket Versioning +id: 657902a9-987d-4879-a1b2-e7a65512824b +version: 1 +date: '2023-05-01' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +data_source: [] +description: The following analytic detects AWS cloudtrail events where bucket versioning is suspended by a user. Versioning allows the AWS Administrators to maintain different version of the S3 bucket which can be used to recover deleted data. Adversaries have leveraged this technique in the wild during a ransomware incident to disable versioning so the client cannot recover the data. +search: '`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended +| stats count values(requestParameters.bucketName) as bucket_name values(resources{}.ARN) as resource_arn by src_ip aws_account_id awsRegion eventName userAgent user_arn userIdentity.principalId errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_disable_bucket_versioning_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs. +references: +- https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82 +tags: + analytic_story: + - Suspicious AWS S3 Activities + - Data Exfiltration + asset_type: AWS Account + confidence: 80 + impact: 80 + message: Bucket Versioning is suspended for S3 buckets- $bucket_name$ by user $user_arn$ from IP address $src_ip$ + mitre_attack_id: + - T1490 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - aws_account_id + - destinationLocationArn + - sourceLocationArn + - userAgent + - userIdentity.principalId + risk_score: 64 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml similarity index 77% rename from detections/cloud/detect_shared_ec2_snapshot.yml rename to detections/cloud/aws_ec2_snapshot_shared_externally.yml index 9c5ee6ee35..3a434a24c5 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml @@ -1,7 +1,7 @@ -name: Detect shared ec2 snapshot +name: AWS EC2 Snapshot Shared Externally id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 -version: 2 -date: '2021-07-20' +version: 3 +date: '2023-03-20' author: Bhavin Patel, Splunk status: production type: TTP @@ -10,15 +10,15 @@ description: The following analytic utilizes AWS CloudTrail events to identify w This method is used by adversaries to exfiltrate the EC2 snapshot. data_source: [] search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId - as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No - Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id - aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` ' + as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent userIdentity.principalId | where match = "No Match" | `aws_ec2_snapshot_shared_externally_filter` ' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. references: - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/ +- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ tags: analytic_story: - Suspicious Cloud Instance Activities @@ -39,6 +39,10 @@ tags: type: IP Address role: - Attacker + - name: aws_account_id + type: Other + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -52,6 +56,7 @@ tags: - aws_account_id - vendor_region - user_agent + - userIdentity.principalId risk_score: 48 security_domain: threat tests: diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml new file mode 100644 index 0000000000..060f38fe38 --- /dev/null +++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml @@ -0,0 +1,60 @@ +name: AWS Exfiltration via Anomalous GetObject API Activity +id: e4384bbf-5835-4831-8d85-694de6ad2cc6 +version: 1 +date: '2023-04-10' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +data_source: [] +description: This search uses built in Splunk command `| anomalydetection` to detect anomalies with respect to users making high number of GetObject API calls to download objects from S3 in a 10 minute time window. The field `probable_cause` is the name of the field that best explains why the event is anomalous. This command identifies anomalous events by computing a probability for each GetObject event by "count" "user_type" "user_arn" and detects anomaly based on the frequencies. +search: '`cloudtrail` eventName=GetObject | bin _time span=10m | stats count values(requestParameters.bucketName) as bucketName by _time src_ip aws_account_id user_type user_arn userIdentity.principalId +| anomalydetection "count" "user_type" "user_arn" action=annotate | search probable_cause=* |`aws_exfiltration_via_anomalous_getobject_api_activity_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +known_false_positives: It is possible that a user downloaded these files to use them locally and there are AWS services in configured that perform these activities for a legitimate reason. Filter is needed. +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Anomalydetection +- https://www.vectra.ai/blogpost/abusing-the-replicator-silently-exfiltrating-data-with-the-aws-s3-replication-service +tags: + analytic_story: + - Data Exfiltration + asset_type: AWS Account + confidence: 80 + impact: 80 + message: Anomalous S3 activities detected by user $user_arn$ from $src_ip$ + mitre_attack_id: + - T1119 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - aws_account_id + - userAgent + - userIdentity.principalId + risk_score: 64 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml new file mode 100644 index 0000000000..0131d71200 --- /dev/null +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -0,0 +1,57 @@ +name: AWS Exfiltration via Batch Service +id: 04455dd3-ced7-480f-b8e6-5469b99e98e2 +version: 1 +date: '2023-04-24' +author: '' +status: production +type: TTP +data_source: [] +description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. +search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. +references: +- https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ +tags: + analytic_story: + - Data Exfiltration + asset_type: AWS Account + confidence: 80 + impact: 80 + message: AWS Batch Job is created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + mitre_attack_id: + - T1119 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - aws_account_id + - userAgent + risk_score: 64 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml new file mode 100644 index 0000000000..542e552042 --- /dev/null +++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml @@ -0,0 +1,66 @@ +name: AWS Exfiltration via Bucket Replication +id: eeb432d6-2212-43b6-9e89-fcd753f7da4c +version: 1 +date: '2023-04-28' +author: Bhavin Patel, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\ + + S3 bucket replication can also be used for cross-account replication, where data is replicated from a source bucket owned by one AWS account to a destination bucket owned by a different AWS account. +search: '`cloudtrail` eventName = PutBucketReplication eventSource = s3.amazonaws.com +| rename requestParameters.* as * +| stats count values(bucketName) as source_bucket values(ReplicationConfiguration.Rule.ID) as rule_id values(ReplicationConfiguration.Rule.Destination.Bucket) as destination_bucket by _time user_arn userName user_type src_ip aws_account_id userIdentity.principalId user_agent | `aws_exfiltration_via_ec2_snapshot_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: It is possible that an AWS admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies. +references: +- https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ +tags: + analytic_story: + - Suspicious AWS S3 Activities + - Data Exfiltration + asset_type: EC2 Snapshot + confidence: 80 + impact: 80 + message: AWS Bucket Replication rule $rule$ added on $source_bucket$ to $destination_bucket$ by user $user_arn$ from IP Address - $src_ip$ + mitre_attack_id: + - T1537 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - eventSource + - requestParameters.* + - aws_account_id + - vendor_region + - user_agent + - userIdentity.principalId + risk_score: 64 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml new file mode 100644 index 0000000000..99a57afc1c --- /dev/null +++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml @@ -0,0 +1,61 @@ +name: AWS Exfiltration via DataSync Task +id: 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2 +version: 1 +date: '2023-04-10' +author: Bhavin Patel, Splunk +status: production +type: TTP +data_source: [] +description: This search looks for potential misuse of an AWS service known as DataSync. This AWS service is used to transfer data between different AWS cloud storage services, such as Amazon S3, Amazon EFS, and Amazon FSx for Windows File Server. Attackers can create a task in AWS to periodically copy data from a private AWS location to a public location resulting in the compromise of the data. +search: '`cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com" | rename requestParameters.* as * | stats count min(_time) as firstTime max(_time) as lastTime by src_ip aws_account_id awsRegion eventName destinationLocationArn sourceLocationArn userAgent user_arn userIdentity.principalId errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +tags: + analytic_story: + - Suspicious AWS S3 Activities + - Data Exfiltration + asset_type: AWS Account + confidence: 80 + impact: 80 + message: DataSync task created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + mitre_attack_id: + - T1119 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - aws_account_id + - destinationLocationArn + - sourceLocationArn + - userAgent + - userIdentity.principalId + risk_score: 64 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml new file mode 100644 index 0000000000..6a5bb174d4 --- /dev/null +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -0,0 +1,63 @@ +name: AWS Exfiltration via EC2 Snapshot +id: ac90b339-13fc-4f29-a18c-4abbba1f2171 +version: 1 +date: '2023-03-22' +author: Bhavin Patel, Splunk +status: production +type: TTP +data_source: [] +description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. +search: '`cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip !="guardduty.amazonaws.com" | bin _time span=5m | stats count dc(eventName) as distinct_api_calls values(eventName) values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id | where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment. +known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization. +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html +tags: + analytic_story: + - Suspicious Cloud Instance Activities + - Data Exfiltration + asset_type: EC2 Snapshot + confidence: 80 + impact: 80 + message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + mitre_attack_id: + - T1537 + observable: + - name: user_arn + type: User + role: + - Attacker + - name: src_ip + type: IP Address + role: + - Attacker + - name: aws_account_id + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - requestParameters.attributeType + - aws_account_id + - vendor_region + - user_agent + - userIdentity.principalId + - requestParameters.createVolumePermission.add.items{}.userId + risk_score: 64 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file diff --git a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml new file mode 100644 index 0000000000..6ee0bdda50 --- /dev/null +++ b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml @@ -0,0 +1,54 @@ +name: AWS S3 Exfiltration Behavior Identified +id: 85096389-a443-42df-b89d-200efbb1b560 +version: 1 +date: '2023-05-04' +author: Bhavin Patel, Splunk +status: production +type: Correlation +data_source: [] +description: This correlation search looks at the risk events created by the detection analytics related Collection and Exfiltration techniques used by adversaries. The rule is designed to identify instances where 2 or more analytics unique AWS analytics and 2 or more distinct mitre IDs has triggered for a particular risk object. This alert when triggered may indicate a potential exfiltration in progress. By aggregating these analytics, security teams can swiftly respond to and investigate any suspicious activities, enhancing their ability to protect critical assets and prevent unauthorized access to sensitive information. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message from datamodel=Risk.All_Risk where All_Risk.annotations.mitre_attack.mitre_tactic = "collection" OR All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration" source = *AWS* by All_Risk.risk_object +| `drop_dm_object_name(All_Risk)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | where source_count >= 2 and mitre_tactic_id_count>=2 | `aws_s3_exfiltration_behavior_identified_filter`' +how_to_implement: You must enable all the detection searches in the Data Exfiltration Analytic story to create risk events in Enterprise Security. +known_false_positives: alse positives may be present based on automated tooling or system administrators. Filter as needed. +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/ +- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ +tags: + analytic_story: + - Suspicious Cloud Instance Activities + - Data Exfiltration + asset_type: AWS Account + confidence: 90 + impact: 90 + message: Multiple AWS Exfiltration detections $source$ and techniques $All_Risk.annotations.mitre_attack.mitre_tactic_id$ trigged for risk object $risk_object$ + mitre_attack_id: + - T1537 + observable: + - name: risk_object + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - All_Risk.analyticstories + - All_Risk.risk_object_type + - All_Risk.risk_object + - All_Risk.annotations.mitre_attack.mitre_tactic + - All_Risk.calculated_risk_score + - source + risk_score: 81 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_exfil_risk_events/aws_risk.log + sourcetype: stash + source: aws_exfil + update_timestamp: true diff --git a/stories/suspicious_aws_s3_activities.yml b/stories/suspicious_aws_s3_activities.yml index e2f1ac3589..fa07973722 100644 --- a/stories/suspicious_aws_s3_activities.yml +++ b/stories/suspicious_aws_s3_activities.yml @@ -1,27 +1,21 @@ name: Suspicious AWS S3 Activities id: 66732346-8fb0-407b-9633-da16756567d6 -version: 2 -date: '2018-07-24' +version: 3 +date: '2023-04-24' author: Bhavin Patel, Splunk -description: Use the searches in this Analytic Story to monitor your AWS S3 buckets +description: Use the searches in this Analytic Story using Cloudtrail logs to to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open - S3 buckets and buckets being accessed from a new IP. The contextual and investigative - searches will give you more information, when required. -narrative: 'As cloud computing has exploded, so has the number of creative attacks - on virtual environments. And as the number-two cloud-service provider, Amazon Web - Services (AWS) has certainly had its share.\ + S3 buckets and buckets being accessed from a new IP, permission and policy updates to the bucket, potential misuse of other services leading to data being leaked. - Amazon''s "shared responsibility" model dictates that the company has responsibility - for the environment outside of the VM and the customer is responsible for the security - inside of the S3 container. As such, it''s important to stay vigilant for activities - that may belie suspicious behavior inside of your environment.\ +narrative: 'One of the most common ways that attackers attempt to steal data from S3 is by gaining unauthorized access to S3 buckets and copying or exfiltrating data to external locations.\ - Among things to look out for are S3 access from unfamiliar locations and by unfamiliar - users. Some of the searches in this Analytic Story help you detect suspicious behavior - and others help you investigate more deeply, when the situation warrants. ' + However, suspicious S3 activities can refer to any unusual behavior detected within an Amazon Web Services (AWS) Simple Storage Service (S3) bucket, including unauthorized access, unusual data transfer patterns, and access attempts from unknown IP addresses. \ + + It is important for organizations to regularly monitor S3 activities for suspicious behavior and implement security best practices, such as using access controls, encryption, and strong authentication mechanisms, to protect sensitive data stored within S3 buckets. By staying vigilant and taking proactive measures, organizations can help prevent potential security breaches and minimize the impact of attacks if they do occur.' references: -- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf +- https://github.com/nagwww/s3-leaks - https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/ +- tags: analytic_story: Suspicious AWS S3 Activities category: