diff --git a/docs/splunk_docs_categories.wiki b/docs/splunk_docs_categories.wiki index 9455fd6ea4..3538b5534b 100644 --- a/docs/splunk_docs_categories.wiki +++ b/docs/splunk_docs_categories.wiki @@ -309,6 +309,55 @@ version = 1.0 +===Container Implantation Monitoring & Investigation=== + +Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. + +
+
+ +====Narrative==== +Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. + +====Providing Technologies==== +* GCP + +====Data Models==== +* Vulnerabilities + +====Mappings==== + +=====ATT&CK===== +* Command and Control +* Exfiltration + +=====Kill Chain Phases===== +* Command and Control + +=====CIS===== +* CIS 3 +* CIS 8 +* CIS 12 + +=====NIST===== +* PR.IP +* PR.PT +* PR.AC +* DE.AE +* DE.CM + +====References==== +* https://github.com/splunk/cloud-datamodel-security-research + +creation_date = 2020-02-20 + +modification_date = 2020-02-20 + +version = 1.0 + +
+
+ ===Suspicious AWS EC2 Activities=== Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. diff --git a/docs/stories_categories.md b/docs/stories_categories.md index d685a0be5d..d94946df59 100644 --- a/docs/stories_categories.md +++ b/docs/stories_categories.md @@ -28,6 +28,8 @@ Analytics stories organized by categories * [Cloud Cryptomining](#cloud-cryptomining) +* [Container Implantation Monitoring & Investigation](#container-implantation-monitoring-&-investigation) + * [Suspicious AWS EC2 Activities](#suspicious-aws-ec2-activities) * [Suspicious AWS Login Activities](#suspicious-aws-login-activities) @@ -373,6 +375,58 @@ Cloud_Infrastructure ##### References * https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf +### Container Implantation Monitoring & Investigation +* id = `aa0e28b1-0521-4b6f-9d2a-7b87e34af246` +* creation_date = 2020-02-20 +* modification_date = 2020-02-20 +* version = 1.0 +* spec_version = 2 + +##### Description +Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. + +##### Narrative +Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. + +##### Detections +* AWS ECR container uploaded +* GCP GCR container uploaded + +##### Providing Technologies +* GCP + +##### Data Models +Vulnerabilities + +##### Mappings + +###### ATT&CK +* Command and Control +* Exfiltration + +###### Kill Chain Phases +* Command and Control + +###### CIS +* CIS 3 +* CIS 8 +* CIS 12 + +###### NIST +* PR.IP +* PR.PT +* PR.AC +* DE.AE +* DE.CM + +##### Maintainers +* name = Rod Soto, Rico Valdez +* email = rsoto@splunk.com, rvaldez@splunk.com +* company = Splunk + +##### References +* https://github.com/splunk/cloud-datamodel-security-research + ### Suspicious AWS EC2 Activities * id = `2e8948a5-5239-406b-b56b-6c50f1268af3` * creation_date = 2018-02-09 @@ -2814,6 +2868,7 @@ The detection searches in this Analytic Story monitor access to the Local Securi * Creation of Shadow Copy with wmic and powershell * Credential Dumping via Copy Command from Shadowcopy * Credential Dumping via Symlink to Shadowcopy +* Dump LSASS via comsvcs DLL ##### Providing Technologies * Microsoft Windows diff --git a/package/app.manifest b/package/app.manifest index b6e5264cb3..860ae5c842 100644 --- a/package/app.manifest +++ b/package/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "1.0.50" + "version": "1.0.51" }, "author": [ { diff --git a/package/default/analytic_stories.conf b/package/default/analytic_stories.conf index 5001e1ef98..99fb348fbe 100644 --- a/package/default/analytic_stories.conf +++ b/package/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2020-02-07T19:18:23 UTC +# On Date: 2020-02-27T23:35:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -264,6 +264,22 @@ description = Detect DNS and web requests to fake websites generated by the Evil narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. +[Container Implantation Monitoring & Investigation] +category = Cloud Security +creation_date = 2020-02-20 +modification_date = +id = aa0e28b1-0521-4b6f-9d2a-7b87e34af246 +version = 1.0 +reference = ["https://github.com/splunk/cloud-datamodel-security-research"] +detection_searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"] +mappings = {"cis20": [], "kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"], "nist": []} +investigative_searches = [] +support_searches = [] +data_models = ["Vulnerabilities"] +providing_technologies = ["AWS", "GCP"] +description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. +narrative = Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. + [Credential Dumping] category = Adversary Tactics creation_date = 2018-08-08 @@ -271,7 +287,7 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 2.0 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg.exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg.exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["Credential Access", "Credential Dumping", "Execution", "PowerShell", "Scripting"], "mitre_technique_id": ["T1003", "T1064", "T1086"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Previous Unseen User"] support_searches = [] diff --git a/package/default/analyticstories.conf b/package/default/analyticstories.conf index 8d24c288aa..2a31110fc7 100644 --- a/package/default/analyticstories.conf +++ b/package/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2020-02-07T19:18:23 UTC +# On Date: 2020-02-27T23:35:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -194,6 +194,17 @@ description = Detect DNS and web requests to fake websites generated by the Evil narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. +[analytic_story://Container Implantation Monitoring & Investigation] +category = Cloud Security +last_updated = +version = 1.0 +references = ["https://github.com/splunk/cloud-datamodel-security-research"] +maintainers = [{"company": "Splunk", "email": "rsoto@splunk.com, rvaldez@splunk.com", "name": "Rod Soto, Rico Valdez"}] +spec_version = 2 +searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"] +description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. +narrative = Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. + [analytic_story://Credential Dumping] category = Adversary Tactics last_updated = 2020-02-04 @@ -201,7 +212,7 @@ version = 2.0 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}, {"company": "Splunk", "email": "pbareiss@splunk.com", "name": "Patrick Bareiss"}] spec_version = 2 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg.exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Previous Unseen User"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg.exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Previous Unseen User"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -1783,6 +1794,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +[savedsearch://ESCU - Dump LSASS via comsvcs DLL - Rule] +type = detection +asset_type = Endpoint +confidence = high +explanation = LSASS is the Local Security Authority Subsystem Service, which is responsible for storing the user credentials. There are multiple ways to attack LSASS. This search detects the usage of comsvcs.dll for dumping the LSASS process. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Credential Access", "Credential Dumping"], "mitre_technique_id": ["T1003"], "nist": ["DE.CM"]} +known_false_positives = None identified. +providing_technologies = ["Sysmon"] + [savedsearch://ESCU - EC2 Instance Modified With Previously Unseen User - Rule] type = detection asset_type = AWS Instance @@ -1935,6 +1956,16 @@ annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and C known_false_positives = Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +[savedsearch://ESCU - GCP GCR container uploaded - Rule] +type = detection +asset_type = GCP GCR Container +confidence = medium +explanation = In this search we can detect if a new container has been uploaded to Google Container Registry, operator can monitor users uploading containers, object paths of new uploaded containers. +how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a subpub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model. +annotations = {"kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"]} +known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. GCP GCR registers container upload as a Storage event, this search must be considered under the context of CONTAINER upload creation which automatically generates a bucket entry for destination path. +providing_technologies = ["GCP"] + [savedsearch://ESCU - Hiding Files And Directories With Attrib.exe - Rule] type = detection asset_type = @@ -2075,6 +2106,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = None at this time providing_technologies = ["Splunk Stream", "Bro", "Bluecoat", "Palo Alto Firewall"] +[savedsearch://ESCU - New container uploaded to AWS ECR - Rule] +type = detection +asset_type = AWS ECR container +confidence = medium +explanation = In this search we can detect if a new container has been uploaded to Amazon Elastic Container Registry, operator can monitor users uploading containers, image ids of new uploaded containers. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. +annotations = {"kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"]} +known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. +providing_technologies = ["AWS"] + [savedsearch://ESCU - No Windows Updates in a time frame - Rule] type = detection asset_type = Endpoint @@ -3139,6 +3180,14 @@ known_false_positives = None at this time earliest_time_offset = 3600 latest_time_offset = 3600 +[savedsearch://ESCU - Investigate AWS ECR container listing activity] +type = investigation +explanation = none +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.You must also install Cloud Infrastructure Data Model. +known_false_positives = None at this time +earliest_time_offset = 14400 +latest_time_offset = 0 + [savedsearch://ESCU - Investigate AWS User Activities by user field] type = investigation explanation = none diff --git a/package/default/app.conf b/package/default/app.conf index 71e557646b..c54be8971e 100644 --- a/package/default/app.conf +++ b/package/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 4412 +build = 4587 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 1.0.50 +version = 1.0.51 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/package/default/content-version.conf b/package/default/content-version.conf index d05001f602..d5b404e9e6 100644 --- a/package/default/content-version.conf +++ b/package/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 1.0.50 +version = 1.0.51 diff --git a/package/default/macros.conf b/package/default/macros.conf index fbbc0fa2ba..819d2f4ef7 100644 --- a/package/default/macros.conf +++ b/package/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2020-02-07T19:18:23 UTC +# On Date: 2020-02-27T23:35:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -34,6 +34,14 @@ description = This macro limits the output to only domains that are in the brand definition = search * description = Use this macro to add additional filters for monitoring clients connecting to multiple dns servers +[container_implant_aws_detection_filter] +definition = search * +description = Use this macro to add additional filters + +[container_implant_gcp_detection_filter] +definition = search * +description = Use this macro to add additional filters + [create_or_delete_windows_shares_filter] definition = search * description = Use this macro to add additional filter for create or delete windows shares @@ -82,6 +90,10 @@ description = Use this macro to add additional filters for monitoring DNS query definition = search * description = Use this macro to add additional filters for monitoring DNS records changed +[dump_lsass_via_comsvcs_dll_filter] +definition = search * +description = Use this macro to add additional filter for dump lsass via comsvcs dll filter + [dynamic_dns_providers] definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user. diff --git a/package/default/savedsearches.conf b/package/default/savedsearches.conf index 238fabe7f7..b418fb461d 100644 --- a/package/default/savedsearches.conf +++ b/package/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2020-02-07T19:18:23 UTC +# On Date: 2020-02-27T23:35:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -619,7 +619,7 @@ quantity = 0 realtime_schedule = 0 schedule_window = auto is_visible = false -search = `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` +search = `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` [ESCU - Attempt To Add Certificate To Untrusted Store - Rule] action.escu = 0 @@ -4185,6 +4185,57 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy" by Registry.dest, Registry.registry_key_name Registry.status Registry.user Registry.registry_path Registry.action | `drop_dm_object_name(Registry)` +[ESCU - Dump LSASS via comsvcs DLL - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Detect the usage of comsvcs.dll for dumping the lsass process. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Credential Access", "Credential Dumping"], "mitre_technique_id": ["T1003"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = LSASS is the Local Security Authority Subsystem Service, which is responsible for storing the user credentials. There are multiple ways to attack LSASS. This search detects the usage of comsvcs.dll for dumping the LSASS process. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. +action.escu.known_false_positives = None identified. +action.escu.creation_date = 2020-02-21 +action.escu.modification_date = 2020-02-21 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule +action.escu.search_type = detection +action.escu.asset_at_risk = Endpoint +action.escu.fields_required = ["dest"] +action.escu.entities = ["dest"] +action.escu.providing_technologies = ["Sysmon"] +action.escu.analytic_story = ["Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = Dump LSASS via comsvcs DLL +action.notable = 1 +action.notable.param.nes_fields = user, process_name, process +action.notable.param.rule_description = An attempt to dump credentials of lsass by $user$ was detected. +action.notable.param.rule_title = Dump LSASS via comsvcs DLL +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 80 +action.risk.param.verbose = 0 +alert.digest_mode = 1 +alert.suppress = 1 +alert.suppress.fields = process_name, dest +alert.suppress.period = 86400s +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +schedule_window = auto +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter` + [ESCU - EC2 Instance Modified With Previously Unseen User - Rule] action.escu = 0 action.escu.enabled = 1 @@ -4945,6 +4996,53 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process Processes.process_name Processes.parent_process_name Processes.dest| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search [| tstats `security_content_summariesonly` earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process | `drop_dm_object_name(Processes)` | inputlookup append=t previously_seen_cmd_line_arguments | stats min(firstTime) as firstTime, max(lastTime) as lastTime by process | outputlookup previously_seen_cmd_line_arguments | eval newCmdLineArgument=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) | where newCmdLineArgument=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table process] | `first_time_seen_cmd_line_filter` +[ESCU - GCP GCR container uploaded - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path. +action.escu.mappings = {"kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"]} +action.escu.data_models = ["Vulnerabilities"] +action.escu.eli5 = In this search we can detect if a new container has been uploaded to Google Container Registry, operator can monitor users uploading containers, object paths of new uploaded containers. +action.escu.how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a subpub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model. +action.escu.known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. GCP GCR registers container upload as a Storage event, this search must be considered under the context of CONTAINER upload creation which automatically generates a bucket entry for destination path. +action.escu.creation_date = 2020-02-20 +action.escu.modification_date = 2020-02-20 +action.escu.confidence = medium +action.escu.full_search_name = ESCU - GCP GCR container uploaded - Rule +action.escu.search_type = detection +action.escu.asset_at_risk = GCP GCR Container +action.escu.fields_required = ["src_user"] +action.escu.entities = ["src_user"] +action.escu.providing_technologies = ["GCP"] +action.escu.analytic_story = ["Container Implantation Monitoring & Investigation"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = GCP GCR container uploaded +action.notable = 1 +action.notable.param.nes_fields = awsRegion +action.notable.param.rule_description = An AWS instance is started in a new, previously unseen, region +action.notable.param.rule_title = AWS instance is started in a new region +action.notable.param.security_domain = threat +action.notable.param.severity = medium +action.risk = 1 +action.risk.param._risk_object = awsRegion +action.risk.param._risk_object_type = other +action.risk.param._risk_score = 30 +action.risk.param.verbose = 0 +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +schedule_window = auto +is_visible = false +search = |tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Storage where Storage.event_name=storage.objects.create by Storage.src_user Storage.account Storage.action Storage.bucket_name Storage.event_name Storage.http_user_agent Storage.msg Storage.object_path | `drop_dm_object_name("Storage")` | `container_implant_gcp_detection_filter` + [ESCU - Hiding Files And Directories With Attrib.exe - Rule] action.escu = 0 action.escu.enabled = 1 @@ -5661,6 +5759,53 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `brand_abuse_web` +[ESCU - New container uploaded to AWS ECR - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. +action.escu.mappings = {"kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"]} +action.escu.data_models = ["Vulnerabilities"] +action.escu.eli5 = In this search we can detect if a new container has been uploaded to Amazon Elastic Container Registry, operator can monitor users uploading containers, image ids of new uploaded containers. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. +action.escu.known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. +action.escu.creation_date = 2020-02-20 +action.escu.modification_date = 2020-02-20 +action.escu.confidence = medium +action.escu.full_search_name = ESCU - New container uploaded to AWS ECR - Rule +action.escu.search_type = detection +action.escu.asset_at_risk = AWS ECR container +action.escu.fields_required = ["src_user"] +action.escu.entities = ["src_user"] +action.escu.providing_technologies = ["AWS"] +action.escu.analytic_story = ["Container Implantation Monitoring & Investigation"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = New container uploaded to AWS ECR +action.notable = 1 +action.notable.param.nes_fields = awsRegion +action.notable.param.rule_description = An AWS instance is started in a new, previously unseen, region +action.notable.param.rule_title = AWS instance is started in a new region +action.notable.param.security_domain = threat +action.notable.param.severity = medium +action.risk = 1 +action.risk.param._risk_object = awsRegion +action.risk.param._risk_object_type = other +action.risk.param._risk_score = 30 +action.risk.param.verbose = 0 +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +schedule_window = auto +is_visible = false +search = | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.http_user_agent="AWS Internal" AND Compute.event_name="PutImage" by Compute.image_id Compute.src_user Compute.src Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")` | `container_implant_aws_detection_filter` + [ESCU - No Windows Updates in a time frame - Rule] action.escu = 0 action.escu.enabled = 1 @@ -10152,6 +10297,29 @@ schedule_window = auto is_visible = false search = | search sourcetype=stream:http {session_id} | stats values(url) values(http_user_agent) by src_ip status +[ESCU - Investigate AWS ECR container listing activity] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = investigative +action.escu.full_search_name = ESCU - Investigate AWS ECR container listing activity +description = This search lists all the users performing a list image operation on AWS Elastic Container Registry. Listing source user, image id, source IP, user type, http user agent. This search also gives counts of unique user agents per listing source. +action.escu.creation_date = 2020-02-20 +action.escu.modification_date = 2020-02-20 +action.escu.analytic_story = [] +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +action.escu.data_models = ["Cloud_Infrastructure"] +action.escu.providing_technologies = ["AWS"] +action.escu.eli5 = none +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.You must also install Cloud Infrastructure Data Model. +action.escu.known_false_positives = None at this time +action.escu.fields_required = ["src_user"] +action.escu.entities = ["src_user"] +disabled = true +schedule_window = auto +is_visible = false +search = |tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.event_name="ListImages" by Compute.image_id Compute.src_user Compute.src Compute.http_user_agent Compute.user_type | rename "Compute.*" as * |stats values(http_user_agent) as http_user_agent distinct_count(http_user_agent) as unique_ua_count by src_user, image_id, src, user_type | where unique_ua_count > 1 + [ESCU - Investigate AWS User Activities by user field] action.escu = 0 action.escu.enabled = 1 diff --git a/package/default/transforms.conf b/package/default/transforms.conf index 4fb8aadf46..bbdb61a14e 100644 --- a/package/default/transforms.conf +++ b/package/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2020-02-07T19:18:23 UTC +# On Date: 2020-02-27T23:35:19 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/default/use_case_library.conf b/package/default/use_case_library.conf index 8d24c288aa..2a31110fc7 100644 --- a/package/default/use_case_library.conf +++ b/package/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2020-02-07T19:18:23 UTC +# On Date: 2020-02-27T23:35:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -194,6 +194,17 @@ description = Detect DNS and web requests to fake websites generated by the Evil narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. +[analytic_story://Container Implantation Monitoring & Investigation] +category = Cloud Security +last_updated = +version = 1.0 +references = ["https://github.com/splunk/cloud-datamodel-security-research"] +maintainers = [{"company": "Splunk", "email": "rsoto@splunk.com, rvaldez@splunk.com", "name": "Rod Soto, Rico Valdez"}] +spec_version = 2 +searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"] +description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. +narrative = Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. + [analytic_story://Credential Dumping] category = Adversary Tactics last_updated = 2020-02-04 @@ -201,7 +212,7 @@ version = 2.0 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}, {"company": "Splunk", "email": "pbareiss@splunk.com", "name": "Patrick Bareiss"}] spec_version = 2 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg.exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Previous Unseen User"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg.exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Previous Unseen User"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -1783,6 +1794,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +[savedsearch://ESCU - Dump LSASS via comsvcs DLL - Rule] +type = detection +asset_type = Endpoint +confidence = high +explanation = LSASS is the Local Security Authority Subsystem Service, which is responsible for storing the user credentials. There are multiple ways to attack LSASS. This search detects the usage of comsvcs.dll for dumping the LSASS process. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Credential Access", "Credential Dumping"], "mitre_technique_id": ["T1003"], "nist": ["DE.CM"]} +known_false_positives = None identified. +providing_technologies = ["Sysmon"] + [savedsearch://ESCU - EC2 Instance Modified With Previously Unseen User - Rule] type = detection asset_type = AWS Instance @@ -1935,6 +1956,16 @@ annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and C known_false_positives = Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +[savedsearch://ESCU - GCP GCR container uploaded - Rule] +type = detection +asset_type = GCP GCR Container +confidence = medium +explanation = In this search we can detect if a new container has been uploaded to Google Container Registry, operator can monitor users uploading containers, object paths of new uploaded containers. +how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a subpub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model. +annotations = {"kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"]} +known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. GCP GCR registers container upload as a Storage event, this search must be considered under the context of CONTAINER upload creation which automatically generates a bucket entry for destination path. +providing_technologies = ["GCP"] + [savedsearch://ESCU - Hiding Files And Directories With Attrib.exe - Rule] type = detection asset_type = @@ -2075,6 +2106,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = None at this time providing_technologies = ["Splunk Stream", "Bro", "Bluecoat", "Palo Alto Firewall"] +[savedsearch://ESCU - New container uploaded to AWS ECR - Rule] +type = detection +asset_type = AWS ECR container +confidence = medium +explanation = In this search we can detect if a new container has been uploaded to Amazon Elastic Container Registry, operator can monitor users uploading containers, image ids of new uploaded containers. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also install Cloud Infrastructure data model. +annotations = {"kill_chain_phases": ["Weaponization"], "mitre_attack": ["Persistence"], "mitre_technique_id": ["T1525"]} +known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. +providing_technologies = ["AWS"] + [savedsearch://ESCU - No Windows Updates in a time frame - Rule] type = detection asset_type = Endpoint @@ -3139,6 +3180,14 @@ known_false_positives = None at this time earliest_time_offset = 3600 latest_time_offset = 3600 +[savedsearch://ESCU - Investigate AWS ECR container listing activity] +type = investigation +explanation = none +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.You must also install Cloud Infrastructure Data Model. +known_false_positives = None at this time +earliest_time_offset = 14400 +latest_time_offset = 0 + [savedsearch://ESCU - Investigate AWS User Activities by user field] type = investigation explanation = none