diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___dm.yml b/baselines/previously_seen_cloud_compute_creations_by_user_initial___dm.yml similarity index 71% rename from baselines/previously_seen_cloud_compute_creations_by_user___dm.yml rename to baselines/previously_seen_cloud_compute_creations_by_user_initial___dm.yml index c2c68c4414..857d3d2a19 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___dm.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user_initial___dm.yml @@ -1,4 +1,4 @@ -name: Previously Seen Cloud Compute Creations By User - DM +name: Previously Seen Cloud Compute Creations By User - DM - Initial id: dd4ced8a-15a9-4285-94ac-7e4134673bf8 version: 1 date: '2020-08-15' @@ -8,8 +8,9 @@ XXXhow_to_implement: You must be ingesting the approrpiate cloud infrastructure and have the Security Research cloud data model installed. author: Rico Valdez, Splunk search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change - where All_Changes.action=created AND All_Changes.object_category=instance `previously_seen_cloud_compute_creations_by_user_input_filter` - by All_Changes.user | `drop_dm_object_name("Change")` | outputlookup previously_seen_cloud_compute_creations_by_user + where All_Changes.action=created AND All_Changes.object_category=instance + `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user + | `drop_dm_object_name("Change")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count' tags: analytics_story: diff --git a/baselines/previously_seen_cloud_compute_creations_by_user_update___dm.yml b/baselines/previously_seen_cloud_compute_creations_by_user_update___dm.yml new file mode 100644 index 0000000000..db3ec4a3e7 --- /dev/null +++ b/baselines/previously_seen_cloud_compute_creations_by_user_update___dm.yml @@ -0,0 +1,20 @@ +name: Previously Seen Cloud Compute Creations By User - Update - DM +id: 6bf75d69-7766-47bc-8097-e41696807a6f +version: 1 +date: '2020-08-15' +description: This search builds a table of previously seen users that have launched + a cloud compute instance. +XXXhow_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the Security Research cloud data model installed. +author: Rico Valdez, Splunk +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change + where All_Changes.action=created AND All_Changes.object_category=instance + `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user + | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user + | stats min(firstTime) as firstTime max(lastTime) as lastTime by user + | outputlookup previously_seen_cloud_compute_creations_by_user | stats count +tags: + analytics_story: + - Cloud Cryptomining + detections: + - Cloud Compute Instance Created By Previously Unseen User - DM diff --git a/baselines/previously_seen_ec2_launches_by_user___DM.yml b/baselines/previously_seen_ec2_launches_by_user_initial___dm.yml similarity index 100% rename from baselines/previously_seen_ec2_launches_by_user___DM.yml rename to baselines/previously_seen_ec2_launches_by_user_initial___dm.yml diff --git a/baselines/previously_seen_ec2_launches_by_user_update___dm.yml b/baselines/previously_seen_ec2_launches_by_user_update___dm.yml new file mode 100644 index 0000000000..5572d2f2b5 --- /dev/null +++ b/baselines/previously_seen_ec2_launches_by_user_update___dm.yml @@ -0,0 +1,51 @@ +name: Previously Seen EC2 Launches By User - Update - DM +id: 7a6bf377-6c97-41f0-8ba1-fde334aee69c +version: 1 +date: '2020-07-29' +description: This search builds a table of previously seen ARNs that have launched + a EC2 instance. +###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +author: Rico Valdez, Splunk +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes +  where All_Changes.action=created All_Changes.object_category=instance All_Changes.status=success + `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user +  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user_dm +  | stats count' + + + + + +search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) as lastTime + values(All_Changes.object) as Objects from datamodel=Change.All_Changes where All_Changes.action=modified + by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t + previously_seen_cloud_compute_creations_by_user | stats min(firstTime) as firstTime max(lastTime) + as lastTime, values(Objects) as Objects by user | multireport [| table user, firstTime, lastTime + | outputlookup previously_seen_cloud_compute_creations_by_user | where fact=fiction] + [| eval new_user=if(firstTime >= relative_time(now(), + `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), 1, 0) | where new_user=1 + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] + | table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`' + + + +###search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances + errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime + by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv + | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup + previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(), + "-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType + as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn + as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`' + + + + +tags: + analytics_story: + - Suspicious Cloud Change Activities + detections: + - EC2 Instance Started With Previously Unseen User - DM diff --git a/baselines/previously_seen_ec2_modifications_by_user___DM.yml b/baselines/previously_seen_ec2_modifications_by_user_initial___dm.yml similarity index 92% rename from baselines/previously_seen_ec2_modifications_by_user___DM.yml rename to baselines/previously_seen_ec2_modifications_by_user_initial___dm.yml index d88a5c97e9..92aa86162e 100644 --- a/baselines/previously_seen_ec2_modifications_by_user___DM.yml +++ b/baselines/previously_seen_ec2_modifications_by_user_initial___dm.yml @@ -11,10 +11,10 @@ author: Rico Valdez, Splunk search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes   where All_Changes.action=modified All_Changes.object_category=instance All_Changes.status=success `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user -  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user +  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_ec2_modifications_by_user   | stats count' tags: analytics_story: - - Suspicious Cloud Change Activity + - Suspicious Cloud Change Activity - Mustang detections: - EC2 Instance Modified With Previously Unseen User - DM diff --git a/baselines/previously_seen_ec2_modifications_by_user_update___dm.yml b/baselines/previously_seen_ec2_modifications_by_user_update___dm.yml new file mode 100644 index 0000000000..481eabde02 --- /dev/null +++ b/baselines/previously_seen_ec2_modifications_by_user_update___dm.yml @@ -0,0 +1,21 @@ +name: Previously Seen EC2 Modifications By User - Update - DM +id: 534b7d30-7b0c-4510-8f55-65439850d58d +version: 1 +date: '2020-07-29' +###description: This search builds a table of previously seen ARNs that have launched + a EC2 instance. +###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +author: Rico Valdez, Splunk +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes +  where All_Changes.action=modified All_Changes.object_category=instance All_Changes.status=success + `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user +  | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_ec2_modifications_by_user + | stats min(firstTime) as firstTime max(lastTime) as lastTime by user +  | outputlookup previously_seen_ec2_modificationss_by_user | stats count' +tags: + analytics_story: + - Suspicious Cloud Change Activity - Mustang + detections: + - EC2 Instance Modified With Previously Unseen User - DM diff --git a/detections/cloud_compute_instance_created_by_previously_unseen_user___dm.yml b/detections/cloud_compute_instance_created_by_previously_unseen_user___dm.yml index dc011eea89..d7b662c37a 100644 --- a/detections/cloud_compute_instance_created_by_previously_unseen_user___dm.yml +++ b/detections/cloud_compute_instance_created_by_previously_unseen_user___dm.yml @@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, where All_Changes.action=created by All_Changes.user | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTime) as firstTime max(lastTime) as lastTime, values(object) as object by user - | multireport [| table user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user - | where fact=fiction][| eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), + | eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), 1, 0) | where new_user=1 | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`] | table user, object, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`' - -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change - where All_Changes.action=created and All_Changes.object_category=instance `previously_seen_cloud_compute_creations_by_user_input_filter` - by All_Changes.user | `drop_dm_object_name("Change")` | outputlookup previously_seen_cloud_compute_creations_by_user - | stats count' - - known_false_positives: It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior. diff --git a/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml b/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml index dc7717332e..ae73d92e76 100644 --- a/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml +++ b/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml @@ -16,10 +16,9 @@ author: Rico Valdez, Splunk search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time)   as lastTime values(All_Changes.object) as Objects from datamodel=Change.All_Changes   where All_Changes.action=modified by All_Changes.user | `drop_dm_object_name("All_Changes")` -  | inputlookup append=t previously_seen_cloud_compute_creations_by_user  | stats +  | inputlookup append=t previously_seen_ec2_modifications_by_user  | stats   min(firstTime) as firstTime max(lastTime) as lastTime, values(Objects) as Objects by user -  | multireport [| table user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user -  | where fact=fiction][| eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), + | eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`),   1, 0) | where new_user=1 | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`]   | table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`' diff --git a/stories/suspicious_cloud_instance_activities.yml b/stories/suspicious_cloud_instance_activities.yml new file mode 100644 index 0000000000..acbbd9b88f --- /dev/null +++ b/stories/suspicious_cloud_instance_activities.yml @@ -0,0 +1,30 @@ +name: Suspicious Cloud Instance Activities +id: 58c46b15-47b3-4259-86a9-6d45da55de49 +version: 1 +date: '2020-08-20' +XXXdescription: Monitor your cloud infrastructure provisioning activities for behaviors originating from + unfamiliar or unusual locations. These behaviors may indicate that malicious activities + are occurring somewhere within your cloud environment. +narrative: 'Because most enterprise cloud infrastructure activities originate from familiar geographic + locations, monitoring for activity from unknown or unusual regions is an important + security measure. This indicator can be especially useful in environments where + it is impossible to whitelist specific IPs (because they vary).\ + + This Analytic Story was designed to provide you with flexibility in the precision + you employ in specifying legitimate geographic regions. It can be as specific as + an IP address or a city, or as broad as a region (think state) or an entire country. + By determining how precise you want your geographical locations to be and monitoring + for new locations that haven''t previously accessed your environment, you can detect + adversaries as they begin to probe your environment. Since there are legitimate + reasons for activities from unfamiliar locations, this is not a standalone indicator. + Nevertheless, location can be a relevant piece of information that you may wish + to investigate further.' +author: David Dorsey, Splunk +type: ESCU +references: +- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf +tags: + analytics_story: AWS Suspicious Provisioning Activities + usecase: Security Monitoring + category: + - Cloud Security