admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding description. updating dataset url

Browse Source
This commit is contained in:
mvelazco
2022-08-24 11:13:03 -04:00
parent f0926a5372
commit 779ec07f0e
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_automation_runbook_created.yml
+1 -1
View File
@@ -36,7 +36,7 @@ tags:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques//T1078.004/azure_automation_runbook/azure-activity.log
impact: 70
kill_chain_phases:
- Installation
detections/cloud/azure_runbook_webhook_created.yml
+5 -1
View File
@@ -5,7 +5,11 @@ date: '2022-08-23'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: UPDATE_DESCRIPTION
description: The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows
administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python.
One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet.
An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM.
This provides a persistent foothold on the environment.
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded
| stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
| `azure_runbook_webhook_created_filter`'
tests/cloud/azure_automation_runbook_created.test.yml
+1 -1
View File
@@ -7,7 +7,7 @@ tests:
latest_time: now
attack_data:
- file_name: azure-activity.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity.log
source: mscs:azure:audit
sourcetype: mscs:azure:audit
update_timestamp: true