more updates

baselines/previously_seen_cloud_compute_creations_by_user_initial___dm.yml

@@ -1,4 +1,4 @@
-name: Previously Seen Cloud Compute Creations By User - DM
+name: Previously Seen Cloud Compute Creations By User - DM - Initial
 id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
 version: 1
 date: '2020-08-15'
@@ -8,8 +8,9 @@ XXXhow_to_implement: You must be ingesting the approrpiate cloud infrastructure
   and have the Security Research cloud data model installed.
 author: Rico Valdez, Splunk
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
-  where All_Changes.action=created AND All_Changes.object_category=instance `previously_seen_cloud_compute_creations_by_user_input_filter`
-  by All_Changes.user | `drop_dm_object_name("Change")` | outputlookup previously_seen_cloud_compute_creations_by_user
+  where All_Changes.action=created AND All_Changes.object_category=instance 
+  `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user 
+  | `drop_dm_object_name("Change")` | outputlookup previously_seen_cloud_compute_creations_by_user
   | stats count'
 tags:
   analytics_story:

baselines/previously_seen_cloud_compute_creations_by_user_update___dm.yml

@@ -0,0 +1,20 @@
+name: Previously Seen Cloud Compute Creations By User - Update - DM
+id: 6bf75d69-7766-47bc-8097-e41696807a6f
+version: 1
+date: '2020-08-15'
+description: This search builds a table of previously seen users that have launched
+  a cloud compute instance.
+XXXhow_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the Security Research cloud data model installed.
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
+  where All_Changes.action=created AND All_Changes.object_category=instance 
+  `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user 
+  | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user  
+  | stats min(firstTime) as firstTime max(lastTime) as lastTime by user
+  | outputlookup previously_seen_cloud_compute_creations_by_user | stats count
+tags:
+  analytics_story:
+  - Cloud Cryptomining
+  detections:
+  - Cloud Compute Instance Created By Previously Unseen User - DM

baselines/previously_seen_ec2_launches_by_user_update___dm.yml

@@ -0,0 +1,51 @@
+name: Previously Seen EC2 Launches By User - Update - DM
+id: 7a6bf377-6c97-41f0-8ba1-fde334aee69c
+version: 1
+date: '2020-07-29'
+description: This search builds a table of previously seen ARNs that have launched
+  a EC2 instance.
+###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
+  where All_Changes.action=created All_Changes.object_category=instance All_Changes.status=success
+  `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user
+  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user_dm
+  | stats count'
+
+
+
+
+
+search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) as lastTime
+  values(All_Changes.object) as Objects from datamodel=Change.All_Changes where All_Changes.action=modified
+  by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t
+  previously_seen_cloud_compute_creations_by_user | stats min(firstTime) as firstTime max(lastTime)
+  as lastTime, values(Objects) as Objects by user | multireport [| table user, firstTime, lastTime
+  | outputlookup previously_seen_cloud_compute_creations_by_user | where fact=fiction]
+  [| eval new_user=if(firstTime >= relative_time(now(),
+  `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), 1, 0) | where new_user=1
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`]
+  | table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
+
+
+
+###search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
+  errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime
+  by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv
+  | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup
+  previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(),
+  "-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType
+  as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
+  as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
+
+
+
+
+tags:
+  analytics_story:
+  - Suspicious Cloud Change Activities
+  detections:
+  - EC2 Instance Started With Previously Unseen User - DM

baselines/previously_seen_ec2_modifications_by_user_initial___dm.yml

@@ -11,10 +11,10 @@ author: Rico Valdez, Splunk
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.action=modified All_Changes.object_category=instance All_Changes.status=success 
   `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user 
-  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user
+  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_ec2_modifications_by_user
   | stats count'
 tags:
   analytics_story:
-  - Suspicious Cloud Change Activity
+  - Suspicious Cloud Change Activity - Mustang
   detections:
   - EC2 Instance Modified With Previously Unseen User - DM

baselines/previously_seen_ec2_modifications_by_user_update___dm.yml

@@ -0,0 +1,21 @@
+name: Previously Seen EC2 Modifications By User - Update - DM
+id: 534b7d30-7b0c-4510-8f55-65439850d58d
+version: 1
+date: '2020-07-29'
+###description: This search builds a table of previously seen ARNs that have launched
+  a EC2 instance.
+###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
+  where All_Changes.action=modified All_Changes.object_category=instance All_Changes.status=success 
+  `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user 
+  | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_ec2_modifications_by_user
+  | stats min(firstTime) as firstTime max(lastTime) as lastTime by user
+  | outputlookup previously_seen_ec2_modificationss_by_user | stats count'
+tags:
+  analytics_story:
+  - Suspicious Cloud Change Activity - Mustang
+  detections:
+  - EC2 Instance Modified With Previously Unseen User - DM

detections/cloud_compute_instance_created_by_previously_unseen_user___dm.yml

@@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime,
   where All_Changes.action=created by All_Changes.user | `drop_dm_object_name("Change")`
   | inputlookup append=t previously_seen_cloud_compute_creations_by_user  | stats
   min(firstTime) as firstTime max(lastTime) as lastTime, values(object) as object by user
-  | multireport [| table user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user
-  | where fact=fiction][| eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`),
+  | eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`),
   1, 0) | where new_user=1 | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`]
   | table user, object, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
 
-
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
-  where All_Changes.action=created  and All_Changes.object_category=instance `previously_seen_cloud_compute_creations_by_user_input_filter`
-  by All_Changes.user | `drop_dm_object_name("Change")` | outputlookup previously_seen_cloud_compute_creations_by_user
-  | stats count'
-
-
 known_false_positives: It's possible that a user will start to create compute instances
   for the first time, for any number of reasons. Verify with the user launching instances
   that this is the intended behavior.

detections/ec2_instance_modified_with_previously_unseen_user___dm.yml

@@ -16,10 +16,9 @@ author: Rico Valdez, Splunk
 search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time)
   as lastTime values(All_Changes.object) as Objects from datamodel=Change.All_Changes
   where All_Changes.action=modified by All_Changes.user | `drop_dm_object_name("All_Changes")`
-  | inputlookup append=t previously_seen_cloud_compute_creations_by_user  | stats
+  | inputlookup append=t previously_seen_ec2_modifications_by_user  | stats
   min(firstTime) as firstTime max(lastTime) as lastTime, values(Objects) as Objects by user
-  | multireport [| table user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user
-  | where fact=fiction][| eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`),
+  | eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`),
   1, 0) | where new_user=1 | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`]
   | table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
 

stories/suspicious_cloud_instance_activities.yml

@@ -0,0 +1,30 @@
+name: Suspicious Cloud Instance Activities
+id: 58c46b15-47b3-4259-86a9-6d45da55de49
+version: 1
+date: '2020-08-20'
+XXXdescription: Monitor your cloud infrastructure provisioning activities for behaviors originating from
+  unfamiliar or unusual locations. These behaviors may indicate that malicious activities
+  are occurring somewhere within your cloud environment.
+narrative: 'Because most enterprise cloud infrastructure activities originate from familiar geographic
+  locations, monitoring for activity from unknown or unusual regions is an important
+  security measure. This indicator can be especially useful in environments where
+  it is impossible to whitelist specific IPs (because they vary).\
+
+  This Analytic Story was designed to provide you with flexibility in the precision
+  you employ in specifying legitimate geographic regions. It can be as specific as
+  an IP address or a city, or as broad as a region (think state) or an entire country.
+  By determining how precise you want your geographical locations to be and monitoring
+  for new locations that haven''t previously accessed your environment, you can detect
+  adversaries as they begin to probe your environment. Since there are legitimate
+  reasons for activities from unfamiliar locations, this is not a standalone indicator.
+  Nevertheless, location can be a relevant piece of information that you may wish
+  to investigate further.'
+author: David Dorsey, Splunk
+type: ESCU
+references:
+- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
+tags:
+  analytics_story: AWS Suspicious Provisioning Activities
+  usecase: Security Monitoring
+  category:
+  - Cloud Security