More migrations: AWS, Azure, O365

detections/cloud/asl_aws_create_access_key.yml

@@ -20,19 +20,9 @@ tags:
   asset_type: AWS Account
   confidence: 90
   impact: 70
-  message: User $user$ is attempting to create access keys
   mitre_attack_id:
   - T1136.003
   - T1136
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -45,7 +35,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 63
   security_domain: network
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml

@@ -23,13 +23,19 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ created a policy version that allows them to access any resource in their account
+  risk_objects:
+  - field: user
+    type: user
+    score: 49
+  threat_objects: []
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
   asset_type: AWS Account
   confidence: 70
   impact: 70
-  message: User $user$ created a policy version that allows them to access any resource in their account.
   mitre_attack_id:
   - T1078.004
   - T1078
@@ -51,7 +57,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 49
   security_domain: network
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_credential_access_getpassworddata.yml

@@ -23,13 +23,20 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ is seen to make `GetPasswordData` API calls
+  risk_objects:
+  - field: user
+    type: user
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   confidence: 70
   impact: 70
-  message: User $user$ is seen to make `GetPasswordData` API calls 
   mitre_attack_id:
   - T1586
   - T1586.003

detections/cloud/asl_aws_credential_access_rds_password_reset.yml

@@ -22,26 +22,25 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ is seen to reset the password for database
+  risk_objects:
+  - field: user
+    type: user
+    score: 49
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   confidence: 70
   impact: 70
-  message: User $user$ is seen to reset the password for database 
   mitre_attack_id:
   - T1586
   - T1586.003
   - T1110
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -55,7 +54,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 49
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_defense_evasion_putbucketlifecycle.yml

@@ -13,27 +13,26 @@ how_to_implement: The detection is based on Amazon Security Lake events from Ama
 known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
 references:
 - https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/
+rba:
+  message: User $user$ has created a new rule to on an S3 bucket $bucketName$ with short expiration days
+  risk_objects:
+  - field: user
+    type: user
+    score: 20
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS Defense Evasion
   asset_type: AWS Account
   confidence: 40
   impact: 50
-  message: User $user$ has created a new rule to on an S3 bucket $bucketName$ with short expiration days
   mitre_attack_id:
   - T1562.008
   - T1562
   - T1485.001
   - T1485
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -47,7 +46,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 20
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

@@ -37,6 +37,13 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: AWS account is potentially compromised and user $user$ is trying to compromise other accounts
+  risk_objects:
+  - field: user
+    type: user
+    score: 25
+  threat_objects: []
 tags:
   analytic_story:
   - Ransomware Cloud
@@ -46,11 +53,6 @@ tags:
   message: AWS account is potentially compromised and user $user$ is trying to compromise other accounts.
   mitre_attack_id:
   - T1486
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,7 +66,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 25
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_disable_bucket_versioning.yml

@@ -30,6 +30,15 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: Bucket Versioning is suspended for S3 buckets- $bucketName$ by user $user$ from IP address $src_ip$
+  risk_objects:
+  - field: user
+    type: user
+    score: 64
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Suspicious AWS S3 Activities
@@ -37,18 +46,8 @@ tags:
   asset_type: AWS Account
   confidence: 80
   impact: 80
-  message: Bucket Versioning is suspended for S3 buckets- $bucketName$ by user $user$ from IP address $src_ip$
   mitre_attack_id:
   - T1490
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,7 +61,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 64
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_ec2_snapshot_shared_externally.yml

@@ -30,6 +30,15 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: AWS EC2 snapshot from user $user$ is shared publicly by user $user$
+  risk_objects:
+  - field: user
+    type: user
+    score: 48
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities
@@ -37,18 +46,8 @@ tags:
   asset_type: EC2 Snapshot
   confidence: 80
   impact: 60
-  message: AWS EC2 snapshot from user $user$ is shared publicly by user $user$
   mitre_attack_id:
   - T1537
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,7 +61,6 @@ tags:
   - src_endpoint.ip
   - src_endpoint.domain
   - cloud.region
-  risk_score: 48
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_iam_accessdenied_discovery_events.yml

@@ -28,24 +28,23 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
+  risk_objects:
+  - field: user
+    type: user
+    score: 10
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
   asset_type: AWS Account
   confidence: 50
   impact: 20
-  message: User $user$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
   mitre_attack_id:
   - T1580
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -55,7 +54,6 @@ tags:
   - actor.user.uid
   - src_endpoint.ip
   - cloud.region
-  risk_score: 10
   security_domain: access
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_iam_assume_role_policy_brute_force.yml

@@ -29,25 +29,24 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ has caused multiple failures with errorCode AccessDenied, which potentially means adversary is attempting to identify a role name.
+  risk_objects:
+  - field: user
+    type: user
+    score: 28
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
   asset_type: AWS Account
   confidence: 70
   impact: 40
-  message: User $user$ has caused multiple failures with errorCode AccessDenied, which potentially means adversary is attempting to identify a role name.
   mitre_attack_id:
   - T1580
   - T1110
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -58,7 +57,6 @@ tags:
   - actor.user.uid
   - src_endpoint.ip
   - cloud.region
-  risk_score: 28
   security_domain: access
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml

@@ -31,25 +31,24 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
+  risk_objects:
+  - field: user
+    type: user
+    score: 48
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS Network ACL Activity
   asset_type: AWS Instance
   confidence: 80
   impact: 60
-  message: User $user$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
   mitre_attack_id:
   - T1562.007
   - T1562
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,7 +61,6 @@ tags:
   - http_request.user_agent
   - src_endpoint.ip
   - cloud.region
-  risk_score: 48
   security_domain: network
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_network_access_control_list_deleted.yml

@@ -28,25 +28,24 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ from $src_ip$ has sucessfully deleted network ACLs entry.
+  risk_objects:
+  - field: user
+    type: user
+    score: 5
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS Network ACL Activity
   asset_type: AWS Instance
   confidence: 50
   impact: 10
-  message: User $user$ from $src_ip$ has sucessfully deleted network ACLs entry.
   mitre_attack_id:
   - T1562.007
   - T1562
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -59,7 +58,6 @@ tags:
   - http_request.user_agent
   - src_endpoint.ip
   - cloud.region
-  risk_score: 5
   security_domain: network
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_saml_update_identity_provider.yml

@@ -29,6 +29,15 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ from IP address $src_ip$ updated the SAML provider
+  risk_objects:
+  - field: user
+    type: user
+    score: 64
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Cloud Federated Credential Abuse
@@ -38,15 +47,6 @@ tags:
   message: User $user$ from IP address $src_ip$ updated the SAML provider 
   mitre_attack_id:
   - T1078
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -58,7 +58,6 @@ tags:
   - http_request.user_agent
   - src_endpoint.ip
   - cloud.region
-  risk_score: 64
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/asl_aws_updateloginprofile.yml

@@ -27,25 +27,24 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: User $user$ from IP address $src_ip$ updated the login profile of another user
+  risk_objects: 
+  - field: user
+    type: user
+    score: 30
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
   asset_type: AWS Account
   confidence: 60
   impact: 50
-  message: User $user$ from IP address $src_ip$ updated the login profile of another user
   mitre_attack_id:
   - T1136.003
   - T1136
-  observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -57,7 +56,6 @@ tags:
   - http_request.user_agent
   - src_endpoint.ip
   - cloud.region
-  risk_score: 30
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/azure_ad_azurehound_useragent_detected.yml

@@ -31,6 +31,17 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: AzureHound UserAgent String $user_agent$ Detected on Tenant $tenantId$
+  risk_objects:
+  - field: tenantId
+    type: Other
+    score: 80
+  threat_objects:
+  - field: src
+    type: ip_address
+  - field: user_agent
+    type: http_user_agent
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
@@ -42,19 +53,6 @@ tags:
   mitre_attack_id:
   - T1087.004
   - T1526
-  observable:
-  - name: tenantId
-    type: User
-    role:
-    - Victim
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  - name: user_agent
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,7 +62,6 @@ tags:
   - category
   - properties.userAgent
   - tenantId
-  risk_score: 80
   security_domain: identity
 tests:
 - name: True Positive Test

detections/cloud/azure_ad_service_principal_enumeration.yml

@@ -35,6 +35,17 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: $spn_count$ Service Principals have been enumerated by $user$ from IP $src$
+  risk_objects:
+  - field: tenantId
+    type: Other
+    score: 80
+  threat_objects:
+  - field: src
+    type: ip_address
+  - field: user_agent
+    type: http_user_agent
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
@@ -42,23 +53,9 @@ tags:
   asset_type: Azure Tenant
   confidence: 100
   impact: 80
-  message: $spn_count$ Service Principals have been enumerated by $user$ from IP $src$
   mitre_attack_id:
   - T1087.004
   - T1526
-  observable:
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  - name: tenantId
-    type: User
-    role:
-    - Victim
-  - name: user_agent
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -68,7 +65,6 @@ tags:
   - properties.requestUri
   - src
   - user
-  risk_score: 80
   security_domain: identity
 tests:
 - name: True Positive Test

detections/cloud/azure_ad_service_principal_privilege_escalation.yml

@@ -35,25 +35,24 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$servicePrincipal$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba: 
+  message: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
+  risk_objects:
+  - field: servicePrincipal
+    type: user
+    score: 100
+  threat_objects:
+  - field: user_agent
+    type: http_user_agent
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
   asset_type: Azure Tenant
   confidence: 100
   impact: 100
-  message: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
   mitre_attack_id:
   - T1098.003
   - T1098
-  observable:
-  - name: servicePrincipal
-    type: User
-    role:
-    - Victim
-  - name: user_agent
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -70,7 +69,6 @@ tags:
   - properties.result
   - properties{}.targetResources{}.modifiedProperties{}
   - properties.targetResources{}.displayName
-  risk_score: 100
   security_domain: identity
 tests:
 - name: True Positive Test

detections/cloud/microsoft_intune_device_health_scripts.yml

@@ -31,21 +31,11 @@ tags:
   asset_type: Azure Tenant
   confidence: 40
   impact: 100
-  message: Intune device health script $TargetObjectId$ was $action$ by user $user$
   mitre_attack_id:
   - T1072
   - T1021.007
   - T1202
   - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: TargetObjectId
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -54,7 +44,6 @@ tags:
   - operationName
   - identity
   - properties.TargetObjectIds{}
-  risk_score: 40
   security_domain: audit
 tests:
 - name: True Positive Test

detections/cloud/microsoft_intune_devicemanagementconfigurationpolicies.yml

@@ -33,22 +33,12 @@ tags:
   asset_type: Azure Tenant
   confidence: 40
   impact: 100
-  message: Intune device management policy $TargetObjectId$ has been $action$ by user $user$
   mitre_attack_id:
   - T1072
   - T1484
   - T1021.007
   - T1562.001
   - T1562.004
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: TargetObjectId
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -57,7 +47,6 @@ tags:
   - operationName
   - identity
   - properties.TargetObjectIds{}
-  risk_score: 40
   security_domain: audit
 tests:
 - name: True Positive Test

detections/cloud/microsoft_intune_manual_device_management.yml

@@ -33,20 +33,10 @@ tags:
   asset_type: Azure Tenant
   confidence: 70
   impact: 20
-  message: Microsoft Intune device management configuration policy action $action$ was performed on $TargetObjectId$ by user $user$
   mitre_attack_id:
   - T1021.007
   - T1072
   - T1529
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: TargetObjectId
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -55,7 +45,6 @@ tags:
   - operationName
   - identity
   - properties.TargetObjectIds{}
-  risk_score: 14
   security_domain: audit
 tests:
 - name: True Positive Test

detections/cloud/microsoft_intune_mobile_apps.yml

@@ -31,21 +31,11 @@ tags:
   asset_type: Azure Tenant
   confidence: 40
   impact: 100
-  message: Intune packed application $TargetDisplayName$ $TargetObjectId$ was $action$ by user $user$
   mitre_attack_id:
   - T1072
   - T1021.007
   - T1202
   - T1105
-  observable:
-  - name: user
-    type: User
-    role:
-    - Attacker
-  - name: TargetObjectId
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -54,7 +44,6 @@ tags:
   - operationName
   - identity
   - properties.TargetObjectIds{}
-  risk_score: 40
   security_domain: audit
 tests:
 - name: True Positive Test

detections/cloud/o365_service_principal_privilege_escalation.yml

@@ -33,6 +33,15 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$servicePrincipal$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
+  risk_objects:
+  - field: servicePrincipal
+    type: user
+    score: 100
+  threat_objects:
+  - field: user_agent
+    type: http_user_agent
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
@@ -40,19 +49,9 @@ tags:
   asset_type: Azure Tenant
   confidence: 100
   impact: 100
-  message: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
   mitre_attack_id:
   - T1098.003
   - T1098
-  observable:
-  - name: servicePrincipal
-    type: User
-    role:
-    - Victim
-  - name: user_agent
-    type: Other
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -66,7 +65,6 @@ tags:
   - user
   - InterSystemsId
   - tenant_id
-  risk_score: 100
   security_domain: identity
 tests:
 - name: True Positive Test