From 7881b4fcd963cbba733a3dbfc5bdfaad034a657f Mon Sep 17 00:00:00 2001 From: Jason Brewer Date: Fri, 17 Jan 2020 16:39:37 -0800 Subject: [PATCH] CRL-1652 - Saving progress so far on MLTK part 2 stuff so it will not interfere. --- .../baseline_api_calls_per_user_arn_mltk.yml | 47 +++++ ...aseline_api_calls_per_user_arn_mltk.ymlbak | 47 +++++ ...seline_api_calls_per_user_arn_mltk.ymlbak2 | 47 +++++ .../baseline_blocked_vpc_traffic_mltk.yml | 54 ++++++ .../baseline_blocked_vpc_traffic_mltk.ymlbak | 54 ++++++ .../baseline_blocked_vpc_traffic_mltk.ymlbak2 | 54 ++++++ ...aseline_network_acl_modifications_mltk.yml | 49 +++++ ...line_network_acl_modifications_mltk.ymlbak | 49 +++++ ...ine_network_acl_modifications_mltk.ymlbak2 | 49 +++++ .../baseline_s3_deletion_by_arn_mltk.yml | 48 +++++ .../baseline_s3_deletion_by_arn_mltk.ymlbak | 48 +++++ .../baseline_s3_deletion_by_arn_mltk.ymlbak2 | 48 +++++ ...ne_security_group_activity_by_arn_mltk.yml | 49 +++++ ...security_group_activity_by_arn_mltk.ymlbak | 49 +++++ ...ecurity_group_activity_by_arn_mltk.ymlbak2 | 49 +++++ detections/aws_spike_acl_activity_mltk.yml | 151 +++++++++++++++ detections/aws_spike_acl_activity_mltk.ymlbak | 151 +++++++++++++++ .../aws_spike_acl_activity_mltk.ymlbak2 | 151 +++++++++++++++ .../spike_aws_api_call_per_account_mltk.yml | 155 +++++++++++++++ ...spike_aws_api_call_per_account_mltk.ymlbak | 155 +++++++++++++++ ...pike_aws_api_call_per_account_mltk.ymlbak2 | 155 +++++++++++++++ ...spike_aws_security_group_activity_mltk.yml | 142 ++++++++++++++ ...ke_aws_security_group_activity_mltk.ymlbak | 142 ++++++++++++++ ...e_aws_security_group_activity_mltk.ymlbak2 | 142 ++++++++++++++ detections/spike_s3_deletion_mltk.yml | 152 +++++++++++++++ detections/spike_s3_deletion_mltk.ymlbak | 152 +++++++++++++++ detections/spike_s3_deletion_mltk.ymlbak2 | 152 +++++++++++++++ detections/spike_vpc_blocked_traffic_mltk.yml | 183 ++++++++++++++++++ .../spike_vpc_blocked_traffic_mltk.ymlbak | 183 ++++++++++++++++++ .../spike_vpc_blocked_traffic_mltk.ymlbak2 | 183 ++++++++++++++++++ throwAwaySubs.sed | 20 ++ 31 files changed, 3110 insertions(+) create mode 100644 baselines/baseline_api_calls_per_user_arn_mltk.yml create mode 100644 baselines/baseline_api_calls_per_user_arn_mltk.ymlbak create mode 100644 baselines/baseline_api_calls_per_user_arn_mltk.ymlbak2 create mode 100644 baselines/baseline_blocked_vpc_traffic_mltk.yml create mode 100644 baselines/baseline_blocked_vpc_traffic_mltk.ymlbak create mode 100644 baselines/baseline_blocked_vpc_traffic_mltk.ymlbak2 create mode 100644 baselines/baseline_network_acl_modifications_mltk.yml create mode 100644 baselines/baseline_network_acl_modifications_mltk.ymlbak create mode 100644 baselines/baseline_network_acl_modifications_mltk.ymlbak2 create mode 100644 baselines/baseline_s3_deletion_by_arn_mltk.yml create mode 100644 baselines/baseline_s3_deletion_by_arn_mltk.ymlbak create mode 100644 baselines/baseline_s3_deletion_by_arn_mltk.ymlbak2 create mode 100644 baselines/baseline_security_group_activity_by_arn_mltk.yml create mode 100644 baselines/baseline_security_group_activity_by_arn_mltk.ymlbak create mode 100644 baselines/baseline_security_group_activity_by_arn_mltk.ymlbak2 create mode 100644 detections/aws_spike_acl_activity_mltk.yml create mode 100644 detections/aws_spike_acl_activity_mltk.ymlbak create mode 100644 detections/aws_spike_acl_activity_mltk.ymlbak2 create mode 100644 detections/spike_aws_api_call_per_account_mltk.yml create mode 100644 detections/spike_aws_api_call_per_account_mltk.ymlbak create mode 100644 detections/spike_aws_api_call_per_account_mltk.ymlbak2 create mode 100644 detections/spike_aws_security_group_activity_mltk.yml create mode 100644 detections/spike_aws_security_group_activity_mltk.ymlbak create mode 100644 detections/spike_aws_security_group_activity_mltk.ymlbak2 create mode 100644 detections/spike_s3_deletion_mltk.yml create mode 100644 detections/spike_s3_deletion_mltk.ymlbak create mode 100644 detections/spike_s3_deletion_mltk.ymlbak2 create mode 100644 detections/spike_vpc_blocked_traffic_mltk.yml create mode 100644 detections/spike_vpc_blocked_traffic_mltk.ymlbak create mode 100644 detections/spike_vpc_blocked_traffic_mltk.ymlbak2 create mode 100644 throwAwaySubs.sed diff --git a/baselines/baseline_api_calls_per_user_arn_mltk.yml b/baselines/baseline_api_calls_per_user_arn_mltk.yml new file mode 100644 index 0000000000..4b74140b07 --- /dev/null +++ b/baselines/baseline_api_calls_per_user_arn_mltk.yml @@ -0,0 +1,47 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats + count +creation_date: '2018-04-09' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of API calls made by each user. Also recorded is the number + of data points for each user. This table is then outputted to a lookup file to allow + the detection search to operate quickly. +eli5: This search returns all log events that are API calls, pulls out the ARN that + initiated each call, and collects them in one-hour groupings. Next, it calculates + the number of API calls made per ARN per hour. For each ARN, it calculates the average + and standard deviation of this count on a per-hour basis. It also includes the + number of data points each ARN had. This table is then stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0 +known_false_positives: '' +maintainers: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +modification_date: '2018-04-09' +name: Baseline of API Calls per User ARN - MLTK +original_authors: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_api_calls_per_user_arn_mltk.ymlbak b/baselines/baseline_api_calls_per_user_arn_mltk.ymlbak new file mode 100644 index 0000000000..ab8128d0e7 --- /dev/null +++ b/baselines/baseline_api_calls_per_user_arn_mltk.ymlbak @@ -0,0 +1,47 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats + count +creation_date: '2018-04-09' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of API calls made by each user. Also recorded is the number + of data points for each user. This table is then outputted to a lookup file to allow + the detection search to operate quickly. +eli5: This search returns all log events that are API calls, pulls out the ARN that + initiated each call, and collects them in one-hour groupings. Next, it calculates + the number of API calls made per ARN per hour. For each ARN, it calculates the average + and standard deviation of this count on a per-hour basis. It also includes the + number of data points each ARN had. This table is then stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 +known_false_positives: '' +maintainers: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +modification_date: '2018-04-09' +name: Baseline of API Calls per User ARN +original_authors: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_api_calls_per_user_arn_mltk.ymlbak2 b/baselines/baseline_api_calls_per_user_arn_mltk.ymlbak2 new file mode 100644 index 0000000000..2bd377522d --- /dev/null +++ b/baselines/baseline_api_calls_per_user_arn_mltk.ymlbak2 @@ -0,0 +1,47 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats + count +creation_date: '2018-04-09' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of API calls made by each user. Also recorded is the number + of data points for each user. This table is then outputted to a lookup file to allow + the detection search to operate quickly. +eli5: This search returns all log events that are API calls, pulls out the ARN that + initiated each call, and collects them in one-hour groupings. Next, it calculates + the number of API calls made per ARN per hour. For each ARN, it calculates the average + and standard deviation of this count on a per-hour basis. It also includes the + number of data points each ARN had. This table is then stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0 +known_false_positives: '' +maintainers: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +modification_date: '2018-04-09' +name: Baseline of API Calls per User ARN +original_authors: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_blocked_vpc_traffic_mltk.yml b/baselines/baseline_blocked_vpc_traffic_mltk.yml new file mode 100644 index 0000000000..07c9b11b53 --- /dev/null +++ b/baselines/baseline_blocked_vpc_traffic_mltk.yml @@ -0,0 +1,54 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -30d@d + latest_time: -10m@m + search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8 + OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND + dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | + stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) + as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) + as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections + by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, + stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections + | stats count +creation_date: '2018-04-26' +data_metadata: + data_source: + - AWS VPC Flow Logs + data_sourcetypes: + - aws:cloudwatchlogs:vpcflow + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of outbound connections blocked in your VPC flow logs by + each source IP address (IP address of your EC2 instances). Also recorded is the + number of data points for each source IP. This table outputs to a lookup file to + allow the detection search to operate quickly. +eli5: Use this search to create a baseline of blocked outbound network connections + by each source IP in your AWS environment. This search returns all log events that + correspond to a blocked outbound network connection, extracts the source IP from + where the outbound connection was initiated, and collects the events in one-hour + groupings. Next, it calculates the number of outbound connections blocked per hour. + For each source IP, it calculates the average and standard deviation of this count + on a per-hour basis. It also includes the number of data points each source IP + had. This table is then stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow + logs.`. +id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-05-07' +name: Baseline of blocked outbound traffic from AWS - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_blocked_vpc_traffic_mltk.ymlbak b/baselines/baseline_blocked_vpc_traffic_mltk.ymlbak new file mode 100644 index 0000000000..fa151bc2ce --- /dev/null +++ b/baselines/baseline_blocked_vpc_traffic_mltk.ymlbak @@ -0,0 +1,54 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -30d@d + latest_time: -10m@m + search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8 + OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND + dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | + stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) + as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) + as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections + by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, + stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections + | stats count +creation_date: '2018-04-26' +data_metadata: + data_source: + - AWS VPC Flow Logs + data_sourcetypes: + - aws:cloudwatchlogs:vpcflow + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of outbound connections blocked in your VPC flow logs by + each source IP address (IP address of your EC2 instances). Also recorded is the + number of data points for each source IP. This table outputs to a lookup file to + allow the detection search to operate quickly. +eli5: Use this search to create a baseline of blocked outbound network connections + by each source IP in your AWS environment. This search returns all log events that + correspond to a blocked outbound network connection, extracts the source IP from + where the outbound connection was initiated, and collects the events in one-hour + groupings. Next, it calculates the number of outbound connections blocked per hour. + For each source IP, it calculates the average and standard deviation of this count + on a per-hour basis. It also includes the number of data points each source IP + had. This table is then stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow + logs.`. +id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-05-07' +name: Baseline of blocked outbound traffic from AWS +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_blocked_vpc_traffic_mltk.ymlbak2 b/baselines/baseline_blocked_vpc_traffic_mltk.ymlbak2 new file mode 100644 index 0000000000..932a519b30 --- /dev/null +++ b/baselines/baseline_blocked_vpc_traffic_mltk.ymlbak2 @@ -0,0 +1,54 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -30d@d + latest_time: -10m@m + search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8 + OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND + dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | + stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) + as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) + as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections + by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, + stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections + | stats count +creation_date: '2018-04-26' +data_metadata: + data_source: + - AWS VPC Flow Logs + data_sourcetypes: + - aws:cloudwatchlogs:vpcflow + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of outbound connections blocked in your VPC flow logs by + each source IP address (IP address of your EC2 instances). Also recorded is the + number of data points for each source IP. This table outputs to a lookup file to + allow the detection search to operate quickly. +eli5: Use this search to create a baseline of blocked outbound network connections + by each source IP in your AWS environment. This search returns all log events that + correspond to a blocked outbound network connection, extracts the source IP from + where the outbound connection was initiated, and collects the events in one-hour + groupings. Next, it calculates the number of outbound connections blocked per hour. + For each source IP, it calculates the average and standard deviation of this count + on a per-hour basis. It also includes the number of data points each source IP + had. This table is then stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow + logs.`. +id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-05-07' +name: Baseline of blocked outbound traffic from AWS +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_network_acl_modifications_mltk.yml b/baselines/baseline_network_acl_modifications_mltk.yml new file mode 100644 index 0000000000..80a3bb7160 --- /dev/null +++ b/baselines/baseline_network_acl_modifications_mltk.yml @@ -0,0 +1,49 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -30d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats + count +creation_date: '2018-05-21' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of API calls that were related to network ACLs made by each + user. Also recorded is the number of data points for each user. This table is then + outputted to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to network ACLs for + the users who initiated this activity. It returns all logged API calls for network + activity, pulls out the ARN that initiated each call, and collects the `eventNames` + in one-hour groupings. Next, it calculates the number of API calls made per ARN + per-hour. For each ARN, it calculates the average and standard deviation of this + count on a per-hour basis. It also includes the number of data points for each ARN. + This table is stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-05-21' +name: Baseline of Network ACL Activity by ARN - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_network_acl_modifications_mltk.ymlbak b/baselines/baseline_network_acl_modifications_mltk.ymlbak new file mode 100644 index 0000000000..9b97d69b7d --- /dev/null +++ b/baselines/baseline_network_acl_modifications_mltk.ymlbak @@ -0,0 +1,49 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -30d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats + count +creation_date: '2018-05-21' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of API calls that were related to network ACLs made by each + user. Also recorded is the number of data points for each user. This table is then + outputted to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to network ACLs for + the users who initiated this activity. It returns all logged API calls for network + activity, pulls out the ARN that initiated each call, and collects the `eventNames` + in one-hour groupings. Next, it calculates the number of API calls made per ARN + per-hour. For each ARN, it calculates the average and standard deviation of this + count on a per-hour basis. It also includes the number of data points for each ARN. + This table is stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +id: fc0edd96-ff2b-4810-9f1f-63da3783fd63 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-05-21' +name: Baseline of Network ACL Activity by ARN +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_network_acl_modifications_mltk.ymlbak2 b/baselines/baseline_network_acl_modifications_mltk.ymlbak2 new file mode 100644 index 0000000000..e614e9563c --- /dev/null +++ b/baselines/baseline_network_acl_modifications_mltk.ymlbak2 @@ -0,0 +1,49 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -30d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats + count +creation_date: '2018-05-21' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation of the number of API calls that were related to network ACLs made by each + user. Also recorded is the number of data points for each user. This table is then + outputted to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to network ACLs for + the users who initiated this activity. It returns all logged API calls for network + activity, pulls out the ARN that initiated each call, and collects the `eventNames` + in one-hour groupings. Next, it calculates the number of API calls made per ARN + per-hour. For each ARN, it calculates the average and standard deviation of this + count on a per-hour basis. It also includes the number of data points for each ARN. + This table is stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-05-21' +name: Baseline of Network ACL Activity by ARN +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_s3_deletion_by_arn_mltk.yml b/baselines/baseline_s3_deletion_by_arn_mltk.yml new file mode 100644 index 0000000000..7d46976567 --- /dev/null +++ b/baselines/baseline_s3_deletion_by_arn_mltk.yml @@ -0,0 +1,48 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count +creation_date: '2018-07-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and standard + deviation for the number of API calls related to deleting an S3 bucket by each user. + Also recorded is the number of data points for each user. This table is then outputted + to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to deleting an S3 + bucket, grouped by the users who initiated this activity. It returns all logged + API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated + each call. Next, it calculates the number of API calls made per ARN per hour. For + each ARN, it calculates the average and standard deviation of this count on a per-hour + basis. It also includes the number of data points for each ARN. This table is stored + in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +id: 5c577fec-61f2-4d38-bae5-c605173fa671 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-07-17' +name: Baseline of S3 Bucket deletion activity by ARN - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_s3_deletion_by_arn_mltk.ymlbak b/baselines/baseline_s3_deletion_by_arn_mltk.ymlbak new file mode 100644 index 0000000000..bf92bae087 --- /dev/null +++ b/baselines/baseline_s3_deletion_by_arn_mltk.ymlbak @@ -0,0 +1,48 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count +creation_date: '2018-07-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and standard + deviation for the number of API calls related to deleting an S3 bucket by each user. + Also recorded is the number of data points for each user. This table is then outputted + to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to deleting an S3 + bucket, grouped by the users who initiated this activity. It returns all logged + API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated + each call. Next, it calculates the number of API calls made per ARN per hour. For + each ARN, it calculates the average and standard deviation of this count on a per-hour + basis. It also includes the number of data points for each ARN. This table is stored + in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-07-17' +name: Baseline of S3 Bucket deletion activity by ARN +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_s3_deletion_by_arn_mltk.ymlbak2 b/baselines/baseline_s3_deletion_by_arn_mltk.ymlbak2 new file mode 100644 index 0000000000..14c84d1746 --- /dev/null +++ b/baselines/baseline_s3_deletion_by_arn_mltk.ymlbak2 @@ -0,0 +1,48 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count +creation_date: '2018-07-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and standard + deviation for the number of API calls related to deleting an S3 bucket by each user. + Also recorded is the number of data points for each user. This table is then outputted + to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to deleting an S3 + bucket, grouped by the users who initiated this activity. It returns all logged + API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated + each call. Next, it calculates the number of API calls made per ARN per hour. For + each ARN, it calculates the average and standard deviation of this count on a per-hour + basis. It also includes the number of data points for each ARN. This table is stored + in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +id: 5c577fec-61f2-4d38-bae5-c605173fa671 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-07-17' +name: Baseline of S3 Bucket deletion activity by ARN +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_security_group_activity_by_arn_mltk.yml b/baselines/baseline_security_group_activity_by_arn_mltk.yml new file mode 100644 index 0000000000..5bbe51fc6a --- /dev/null +++ b/baselines/baseline_security_group_activity_by_arn_mltk.yml @@ -0,0 +1,49 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | + stats count +creation_date: '2018-04-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation for the number of API calls related to security groups made by each user. + Also recorded is the number of data points for each user. This table is then outputted + to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to security groups + by the users who initiated this activity. It returns all logged API calls for all + security-group-related activity, pulls out the ARN that initiated each call, and + collects the `eventNames` in one-hour groupings. Next, it calculates the number + of API calls made per ARN per hour. For each ARN, it calculates the average and + standard deviation of this count on a per-hour basis. It also includes the number + of data points for each ARN. This table is stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +id: 765b3857-8d79-475f-8b21-2bea774cd641 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-04-17' +name: Baseline of Security Group Activity by ARN - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_security_group_activity_by_arn_mltk.ymlbak b/baselines/baseline_security_group_activity_by_arn_mltk.ymlbak new file mode 100644 index 0000000000..aca2ef9bb2 --- /dev/null +++ b/baselines/baseline_security_group_activity_by_arn_mltk.ymlbak @@ -0,0 +1,49 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | + stats count +creation_date: '2018-04-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation for the number of API calls related to security groups made by each user. + Also recorded is the number of data points for each user. This table is then outputted + to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to security groups + by the users who initiated this activity. It returns all logged API calls for all + security-group-related activity, pulls out the ARN that initiated each call, and + collects the `eventNames` in one-hour groupings. Next, it calculates the number + of API calls made per ARN per hour. For each ARN, it calculates the average and + standard deviation of this count on a per-hour basis. It also includes the number + of data points for each ARN. This table is stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-04-17' +name: Baseline of Security Group Activity by ARN +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/baselines/baseline_security_group_activity_by_arn_mltk.ymlbak2 b/baselines/baseline_security_group_activity_by_arn_mltk.ymlbak2 new file mode 100644 index 0000000000..431b9e411c --- /dev/null +++ b/baselines/baseline_security_group_activity_by_arn_mltk.ymlbak2 @@ -0,0 +1,49 @@ +baseline: + splunk: + schedule: + cron_schedule: '' + earliest_time: -90d@d + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn + | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) + as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, + stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, + avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | + stats count +creation_date: '2018-04-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search establishes, on a per-hour basis, the average and the standard + deviation for the number of API calls related to security groups made by each user. + Also recorded is the number of data points for each user. This table is then outputted + to a lookup file to allow the detection search to operate quickly. +eli5: Use this search to create a baseline for API calls related to security groups + by the users who initiated this activity. It returns all logged API calls for all + security-group-related activity, pulls out the ARN that initiated each call, and + collects the `eventNames` in one-hour groupings. Next, it calculates the number + of API calls made per ARN per hour. For each ARN, it calculates the average and + standard deviation of this count on a per-hour basis. It also includes the number + of data points for each ARN. This table is stored in a lookup file. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +id: 765b3857-8d79-475f-8b21-2bea774cd641 +known_false_positives: '' +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +modification_date: '2018-04-17' +name: Baseline of Security Group Activity by ARN +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/aws_spike_acl_activity_mltk.yml b/detections/aws_spike_acl_activity_mltk.yml new file mode 100644 index 0000000000..218fc3cca7 --- /dev/null +++ b/detections/aws_spike_acl_activity_mltk.yml @@ -0,0 +1,151 @@ +asset_type: AWS Instance +baselines: + - id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f + name: Baseline of Network ACL Activity by ARN - MLTK + type: splunk +confidence: medium +creation_date: '2018-05-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes in API activity related + to network access-control lists (ACLs)in your AWS environment. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls related to network + ACLs by $user$ was detected. + rule_title: Spike in AWS Network ACL activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 10 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `network_acl_events` [search sourcetype=aws:cloudtrail + `network_acl_events` | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup network_acl_activity_baseline append=t | + fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for creating/modifying/replacing network Access Control Lists (ACLs).\ + + 1. Kick off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Count the number of API calls per Amazon Resource Name (ARN).\ + + 1. Load the cache file that contains the number of data points, the count from the + latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drop the count from the latest hour, since it is not necessary, and merge the + rest of the data with the results of the stats command. \ + + 1. Rename `apiCalls` as `latestCount`.\ + + 1. Calculate the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. They do the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Update the cache file with the latest results.\ + + 1. Set the minimum threshold for the number of data points and set the number of + standard deviations away from the mean it must be to be considered a spike.\ + + 1. Make a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filter out anything that it determines is not a spike and return the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike. This search works best + when you run the "Baseline of Network ACL Activity by ARN" support search once to + create a lookup file of previously seen Network ACL Activity. To add or remove API + event names related to network ACLs, edit the macro `network_acl_events`. +id: c7bc51d2-330e-46da-a2e6-070909a602de +investigations: + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 + name: AWS Network Interface details via resourceId + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 + name: AWS Network ACL Details from ID + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk +known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` + and `deviationThreshold`. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 12 + - CIS 11 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Persistence + - Exfiltration + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-05-21' +name: Detect Spike in Network ACL Activity - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/aws_spike_acl_activity_mltk.ymlbak b/detections/aws_spike_acl_activity_mltk.ymlbak new file mode 100644 index 0000000000..00446a4958 --- /dev/null +++ b/detections/aws_spike_acl_activity_mltk.ymlbak @@ -0,0 +1,151 @@ +asset_type: AWS Instance +baselines: + - id: fc0edd96-ff2b-4810-9f1f-63da3783fd63 + name: Baseline of Network ACL Activity by ARN + type: splunk +confidence: medium +creation_date: '2018-05-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes in API activity related + to network access-control lists (ACLs)in your AWS environment. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls related to network + ACLs by $user$ was detected. + rule_title: Spike in AWS Network ACL activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 10 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `network_acl_events` [search sourcetype=aws:cloudtrail + `network_acl_events` | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup network_acl_activity_baseline append=t | + fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for creating/modifying/replacing network Access Control Lists (ACLs).\ + + 1. Kick off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Count the number of API calls per Amazon Resource Name (ARN).\ + + 1. Load the cache file that contains the number of data points, the count from the + latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drop the count from the latest hour, since it is not necessary, and merge the + rest of the data with the results of the stats command. \ + + 1. Rename `apiCalls` as `latestCount`.\ + + 1. Calculate the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. They do the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Update the cache file with the latest results.\ + + 1. Set the minimum threshold for the number of data points and set the number of + standard deviations away from the mean it must be to be considered a spike.\ + + 1. Make a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filter out anything that it determines is not a spike and return the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike. This search works best + when you run the "Baseline of Network ACL Activity by ARN" support search once to + create a lookup file of previously seen Network ACL Activity. To add or remove API + event names related to network ACLs, edit the macro `network_acl_events`. +id: ada0f478-84a8-4641-a1f1-e32372d4bd53 +investigations: + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 + name: AWS Network Interface details via resourceId + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 + name: AWS Network ACL Details from ID + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk +known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` + and `deviationThreshold`. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 12 + - CIS 11 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Persistence + - Exfiltration + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-05-21' +name: Detect Spike in Network ACL Activity +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/aws_spike_acl_activity_mltk.ymlbak2 b/detections/aws_spike_acl_activity_mltk.ymlbak2 new file mode 100644 index 0000000000..d6f2a71120 --- /dev/null +++ b/detections/aws_spike_acl_activity_mltk.ymlbak2 @@ -0,0 +1,151 @@ +asset_type: AWS Instance +baselines: + - id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f + name: Baseline of Network ACL Activity by ARN + type: splunk +confidence: medium +creation_date: '2018-05-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes in API activity related + to network access-control lists (ACLs)in your AWS environment. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls related to network + ACLs by $user$ was detected. + rule_title: Spike in AWS Network ACL activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 10 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `network_acl_events` [search sourcetype=aws:cloudtrail + `network_acl_events` | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup network_acl_activity_baseline append=t | + fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for creating/modifying/replacing network Access Control Lists (ACLs).\ + + 1. Kick off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Count the number of API calls per Amazon Resource Name (ARN).\ + + 1. Load the cache file that contains the number of data points, the count from the + latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drop the count from the latest hour, since it is not necessary, and merge the + rest of the data with the results of the stats command. \ + + 1. Rename `apiCalls` as `latestCount`.\ + + 1. Calculate the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. They do the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Update the cache file with the latest results.\ + + 1. Set the minimum threshold for the number of data points and set the number of + standard deviations away from the mean it must be to be considered a spike.\ + + 1. Make a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filter out anything that it determines is not a spike and return the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike. This search works best + when you run the "Baseline of Network ACL Activity by ARN" support search once to + create a lookup file of previously seen Network ACL Activity. To add or remove API + event names related to network ACLs, edit the macro `network_acl_events`. +id: c7bc51d2-330e-46da-a2e6-070909a602de +investigations: + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 + name: AWS Network Interface details via resourceId + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 + name: AWS Network ACL Details from ID + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk +known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` + and `deviationThreshold`. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 12 + - CIS 11 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Persistence + - Exfiltration + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-05-21' +name: Detect Spike in Network ACL Activity +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_aws_api_call_per_account_mltk.yml b/detections/spike_aws_api_call_per_account_mltk.yml new file mode 100644 index 0000000000..892bcd1eb7 --- /dev/null +++ b/detections/spike_aws_api_call_per_account_mltk.yml @@ -0,0 +1,155 @@ +asset_type: AWS Instance +baselines: + - id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0 + name: Baseline of API Calls per User ARN - MLTK + type: splunk +confidence: medium +creation_date: '2018-03-12' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes of API activity in your + AWS environment. It will also update the cache file that factors in the latest + data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls by $user$ was detected. + rule_title: Spike in AWS API activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventType=AwsApiCall [search sourcetype=aws:cloudtrail + eventType=AwsApiCall | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup api_call_by_user_baseline append=t | fields + - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + api_call_by_user_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through a series of steps, + as per the following: \ + + 1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls.\ + + 1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Counts the number of API calls per ARN.\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `apiCalls` as `latestCount`.\ + + 1. Calculates the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike.\ + + This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) + that are not yet supported by ES Incident Review and therefore cannot be viewed + when a notable event is raised. These fields contribute additional context to the + notable. To see the additional metadata, add the following fields, if not already + present, to Incident Review - Event Attributes (Configure > Incident Management + > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** + eventName\ + + 1. \ + + 1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\ + + 1. \ + + 1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\ + + Detailed documentation on how to create a new field within Incident Review may be + found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' +id: 06bf47d6-c47a-4a84-a491-d2857b542e67 +investigations: + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 + name: Investigate AWS User Activities by user field + type: splunk +known_false_positives: '' +maintainers: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-04-09' +name: Detect Spike in AWS API Activity - MLTK +original_authors: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_aws_api_call_per_account_mltk.ymlbak b/detections/spike_aws_api_call_per_account_mltk.ymlbak new file mode 100644 index 0000000000..3643f7b7d2 --- /dev/null +++ b/detections/spike_aws_api_call_per_account_mltk.ymlbak @@ -0,0 +1,155 @@ +asset_type: AWS Instance +baselines: + - id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 + name: Baseline of API Calls per User ARN + type: splunk +confidence: medium +creation_date: '2018-03-12' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes of API activity in your + AWS environment. It will also update the cache file that factors in the latest + data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls by $user$ was detected. + rule_title: Spike in AWS API activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventType=AwsApiCall [search sourcetype=aws:cloudtrail + eventType=AwsApiCall | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup api_call_by_user_baseline append=t | fields + - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + api_call_by_user_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through a series of steps, + as per the following: \ + + 1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls.\ + + 1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Counts the number of API calls per ARN.\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `apiCalls` as `latestCount`.\ + + 1. Calculates the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike.\ + + This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) + that are not yet supported by ES Incident Review and therefore cannot be viewed + when a notable event is raised. These fields contribute additional context to the + notable. To see the additional metadata, add the following fields, if not already + present, to Incident Review - Event Attributes (Configure > Incident Management + > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** + eventName\ + + 1. \ + + 1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\ + + 1. \ + + 1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\ + + Detailed documentation on how to create a new field within Incident Review may be + found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' +id: ada0f478-84a8-4641-a3f1-d32362d4bd55 +investigations: + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 + name: Investigate AWS User Activities by user field + type: splunk +known_false_positives: '' +maintainers: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-04-09' +name: Detect Spike in AWS API Activity +original_authors: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_aws_api_call_per_account_mltk.ymlbak2 b/detections/spike_aws_api_call_per_account_mltk.ymlbak2 new file mode 100644 index 0000000000..de76ca6e6c --- /dev/null +++ b/detections/spike_aws_api_call_per_account_mltk.ymlbak2 @@ -0,0 +1,155 @@ +asset_type: AWS Instance +baselines: + - id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0 + name: Baseline of API Calls per User ARN + type: splunk +confidence: medium +creation_date: '2018-03-12' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes of API activity in your + AWS environment. It will also update the cache file that factors in the latest + data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls by $user$ was detected. + rule_title: Spike in AWS API activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventType=AwsApiCall [search sourcetype=aws:cloudtrail + eventType=AwsApiCall | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup api_call_by_user_baseline append=t | fields + - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + api_call_by_user_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through a series of steps, + as per the following: \ + + 1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls.\ + + 1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Counts the number of API calls per ARN.\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `apiCalls` as `latestCount`.\ + + 1. Calculates the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike.\ + + This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) + that are not yet supported by ES Incident Review and therefore cannot be viewed + when a notable event is raised. These fields contribute additional context to the + notable. To see the additional metadata, add the following fields, if not already + present, to Incident Review - Event Attributes (Configure > Incident Management + > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** + eventName\ + + 1. \ + + 1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\ + + 1. \ + + 1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\ + + Detailed documentation on how to create a new field within Incident Review may be + found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' +id: 06bf47d6-c47a-4a84-a491-d2857b542e67 +investigations: + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 + name: Investigate AWS User Activities by user field + type: splunk +known_false_positives: '' +maintainers: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-04-09' +name: Detect Spike in AWS API Activity +original_authors: + - company: Splunk + email: davidd@splunk.com + name: David Dorsey +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_aws_security_group_activity_mltk.yml b/detections/spike_aws_security_group_activity_mltk.yml new file mode 100644 index 0000000000..4bab4d8a52 --- /dev/null +++ b/detections/spike_aws_security_group_activity_mltk.yml @@ -0,0 +1,142 @@ +asset_type: AWS Instance +baselines: + - id: 765b3857-8d79-475f-8b21-2bea774cd641 + name: Baseline of Security Group Activity by ARN - MLTK + type: splunk +confidence: medium +creation_date: '2018-04-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes in API activity related + to security groups in your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls related to security + groups by $user$ was detected. + rule_title: Spike in AWS Security Group activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `security_group_api_calls` [search sourcetype=aws:cloudtrail + `security_group_api_calls` | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup security_group_activity_baseline append=t + | fields - latestCount | stats values(*) as * by arn | rename apiCalls as + latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 + | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) + | eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + security_group_activity_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for security groups.\ + + 1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Counts the number of API calls per ARN.\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `apiCalls` as `latestCount`.\ + + 1. Calculates the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike.This search works best + when you run the "Baseline of Security Group Activity by ARN" support search once + to create a history of previously seen Security Group Activity. To add or remove + API event names for security groups, edit the macro `security_group_api_calls`. +id: f0a6dda0-a5b2-4b30-977d-ac1b063b8820 +investigations: + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 + name: Investigate AWS User Activities by user field + type: splunk +known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`, + the false positive rate may vary. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-04-18' +name: Detect Spike in Security Group Activity - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_aws_security_group_activity_mltk.ymlbak b/detections/spike_aws_security_group_activity_mltk.ymlbak new file mode 100644 index 0000000000..fa38773664 --- /dev/null +++ b/detections/spike_aws_security_group_activity_mltk.ymlbak @@ -0,0 +1,142 @@ +asset_type: AWS Instance +baselines: + - id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63 + name: Baseline of Security Group Activity by ARN + type: splunk +confidence: medium +creation_date: '2018-04-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes in API activity related + to security groups in your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls related to security + groups by $user$ was detected. + rule_title: Spike in AWS Security Group activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `security_group_api_calls` [search sourcetype=aws:cloudtrail + `security_group_api_calls` | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup security_group_activity_baseline append=t + | fields - latestCount | stats values(*) as * by arn | rename apiCalls as + latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 + | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) + | eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + security_group_activity_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for security groups.\ + + 1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Counts the number of API calls per ARN.\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `apiCalls` as `latestCount`.\ + + 1. Calculates the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike.This search works best + when you run the "Baseline of Security Group Activity by ARN" support search once + to create a history of previously seen Security Group Activity. To add or remove + API event names for security groups, edit the macro `security_group_api_calls`. +id: ada0f478-84a8-4641-a3f1-e32372d4bd53 +investigations: + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 + name: Investigate AWS User Activities by user field + type: splunk +known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`, + the false positive rate may vary. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-04-18' +name: Detect Spike in Security Group Activity +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_aws_security_group_activity_mltk.ymlbak2 b/detections/spike_aws_security_group_activity_mltk.ymlbak2 new file mode 100644 index 0000000000..dae9089444 --- /dev/null +++ b/detections/spike_aws_security_group_activity_mltk.ymlbak2 @@ -0,0 +1,142 @@ +asset_type: AWS Instance +baselines: + - id: 765b3857-8d79-475f-8b21-2bea774cd641 + name: Baseline of Security Group Activity by ARN + type: splunk +confidence: medium +creation_date: '2018-04-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search will detect users creating spikes in API activity related + to security groups in your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of AWS API calls related to security + groups by $user$ was detected. + rule_title: Spike in AWS Security Group activity detected by $user$ + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail `security_group_api_calls` [search sourcetype=aws:cloudtrail + `security_group_api_calls` | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup security_group_activity_baseline append=t + | fields - latestCount | stats values(*) as * by arn | rename apiCalls as + latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 + | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) + | eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + security_group_activity_baseline | eval dataPointThreshold = 15, deviationThreshold + = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) + as uniqueApisCalled by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for security groups.\ + + 1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into + a more friendly format.\ + + 1. Counts the number of API calls per ARN.\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `apiCalls` as `latestCount`.\ + + 1. Calculates the new average value for each ARN with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation--weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of all the + API calls, the number of unique API calls, and the total number of API calls for + each of these ARNs. Finally, it looks up the average and standard deviation and + returns both the average and the number of standard deviations the spike is from + the average.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike.This search works best + when you run the "Baseline of Security Group Activity by ARN" support search once + to create a history of previously seen Security Group Activity. To add or remove + API event names for security groups, edit the macro `security_group_api_calls`. +id: f0a6dda0-a5b2-4b30-977d-ac1b063b8820 +investigations: + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 + name: Investigate AWS User Activities by user field + type: splunk +known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`, + the false positive rate may vary. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-04-18' +name: Detect Spike in Security Group Activity +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_s3_deletion_mltk.yml b/detections/spike_s3_deletion_mltk.yml new file mode 100644 index 0000000000..3da27533db --- /dev/null +++ b/detections/spike_s3_deletion_mltk.yml @@ -0,0 +1,152 @@ +asset_type: S3 Bucket +baselines: + - id: 5c577fec-61f2-4d38-bae5-c605173fa671 + name: Baseline of S3 Bucket deletion activity by ARN - MLTK + type: splunk +confidence: medium +creation_date: '2018-07-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search detects users creating spikes in API activity related to + deletion of S3 buckets in your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of S3 buckets deleted by $user$ was + detected. + rule_title: Spike detected in S3 bucket deletion activity by $user$. + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventName=DeleteBucket [search sourcetype=aws:cloudtrail + eventName=DeleteBucket | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup s3_deletion_baseline append=t | fields - + latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + s3_deletion_baseline | eval dataPointThreshold = 15, deviationThreshold = + 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | spath output=bucketName path=requestParameters.bucketName | stats values(bucketName) + as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled + by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for deletion of S3 buckets.\ + + 1. Kick off a subsearch that retrieves the same data and pulls out and converts + the ARN into a more friendly format.\ + + 1. Count the number of API calls per ARN.\ + + 1. Load the cache file that contains the number of data points, the count from the + latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drop the count from the latest hour, since it is unnecessary, and merge the rest + of the data with the results of the `stats` command. \ + + 1. Rename `apiCalls` as `latestCount`.\ + + 1. Calculate the new average value for each ARN with the latest count, weighting + the past more heavily than the current hour. It does the same for the standard deviation—weighting + the past more heavily than the current.\ + + 1. Update the cache file with the latest results.\ + + 1. Set the minimum threshold for the number of data points and the number of standard + deviations away from the mean it must be to be considered a spike.\ + + 1. Make a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and if the count + is a sufficient number of standard deviations away from the average.\ + + 1. Filter out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of the deleted + S3 buckets, the number of unique API calls, and the total number of API calls for + each of these user ARNs.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike. This search works best + when you run the "Baseline of S3 Bucket deletion activity by ARN" support search + once to create a baseline of previously seen S3 bucket-deletion activity. +id: a26fc0cf-2199-4fab-928d-4b13442ee871 +investigations: + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242 + name: AWS S3 Bucket details via bucketName + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: 446ec87a-85c6-40d4-b060-bea4498281d6 + name: Get All AWS Activity From IP Address + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 + name: Investigate AWS activities via region name + type: splunk +known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`, + the false positive rate may vary. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 13 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-11-27' +name: Detect Spike in S3 Bucket deletion - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_s3_deletion_mltk.ymlbak b/detections/spike_s3_deletion_mltk.ymlbak new file mode 100644 index 0000000000..79327bbbca --- /dev/null +++ b/detections/spike_s3_deletion_mltk.ymlbak @@ -0,0 +1,152 @@ +asset_type: S3 Bucket +baselines: + - id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63 + name: Baseline of S3 Bucket deletion activity by ARN + type: splunk +confidence: medium +creation_date: '2018-07-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search detects users creating spikes in API activity related to + deletion of S3 buckets in your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of S3 buckets deleted by $user$ was + detected. + rule_title: Spike detected in S3 bucket deletion activity by $user$. + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventName=DeleteBucket [search sourcetype=aws:cloudtrail + eventName=DeleteBucket | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup s3_deletion_baseline append=t | fields - + latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + s3_deletion_baseline | eval dataPointThreshold = 15, deviationThreshold = + 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | spath output=bucketName path=requestParameters.bucketName | stats values(bucketName) + as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled + by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for deletion of S3 buckets.\ + + 1. Kick off a subsearch that retrieves the same data and pulls out and converts + the ARN into a more friendly format.\ + + 1. Count the number of API calls per ARN.\ + + 1. Load the cache file that contains the number of data points, the count from the + latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drop the count from the latest hour, since it is unnecessary, and merge the rest + of the data with the results of the `stats` command. \ + + 1. Rename `apiCalls` as `latestCount`.\ + + 1. Calculate the new average value for each ARN with the latest count, weighting + the past more heavily than the current hour. It does the same for the standard deviation—weighting + the past more heavily than the current.\ + + 1. Update the cache file with the latest results.\ + + 1. Set the minimum threshold for the number of data points and the number of standard + deviations away from the mean it must be to be considered a spike.\ + + 1. Make a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and if the count + is a sufficient number of standard deviations away from the average.\ + + 1. Filter out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of the deleted + S3 buckets, the number of unique API calls, and the total number of API calls for + each of these user ARNs.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike. This search works best + when you run the "Baseline of S3 Bucket deletion activity by ARN" support search + once to create a baseline of previously seen S3 bucket-deletion activity. +id: ad12w478-84a8-4641-a3w1-e32372q4bd53 +investigations: + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242 + name: AWS S3 Bucket details via bucketName + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: 446ec87a-85c6-40d4-b060-bea4498281d6 + name: Get All AWS Activity From IP Address + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 + name: Investigate AWS activities via region name + type: splunk +known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`, + the false positive rate may vary. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 13 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-11-27' +name: Detect Spike in S3 Bucket deletion +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_s3_deletion_mltk.ymlbak2 b/detections/spike_s3_deletion_mltk.ymlbak2 new file mode 100644 index 0000000000..a476ff5e91 --- /dev/null +++ b/detections/spike_s3_deletion_mltk.ymlbak2 @@ -0,0 +1,152 @@ +asset_type: S3 Bucket +baselines: + - id: 5c577fec-61f2-4d38-bae5-c605173fa671 + name: Baseline of S3 Bucket deletion activity by ARN + type: splunk +confidence: medium +creation_date: '2018-07-17' +data_metadata: + data_source: + - AWS CloudTrail logs + data_sourcetypes: + - aws:cloudtrail + providing_technologies: + - AWS +description: This search detects users creating spikes in API activity related to + deletion of S3 buckets in your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: A spike in the number of S3 buckets deleted by $user$ was + detected. + rule_title: Spike detected in S3 bucket deletion activity by $user$. + risk: + risk_object: user + risk_object_type: + - user + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudtrail eventName=DeleteBucket [search sourcetype=aws:cloudtrail + eventName=DeleteBucket | spath output=arn path=userIdentity.arn | stats count + as apiCalls by arn | inputlookup s3_deletion_baseline append=t | fields - + latestCount | stats values(*) as * by arn | rename apiCalls as latestCount + | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, + 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval + avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, + stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) + | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup + s3_deletion_baseline | eval dataPointThreshold = 15, deviationThreshold = + 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn + as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn + | spath output=bucketName path=requestParameters.bucketName | stats values(bucketName) + as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled + by user + suppress: + suppress_fields: user + suppress_period: 14400s +eli5: 'This search and its corresponding subsearch run through the following series + of steps: \ + + 1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls + specifically for deletion of S3 buckets.\ + + 1. Kick off a subsearch that retrieves the same data and pulls out and converts + the ARN into a more friendly format.\ + + 1. Count the number of API calls per ARN.\ + + 1. Load the cache file that contains the number of data points, the count from the + latest hour, the API call average, and the standard deviation for each ARN.\ + + 1. Drop the count from the latest hour, since it is unnecessary, and merge the rest + of the data with the results of the `stats` command. \ + + 1. Rename `apiCalls` as `latestCount`.\ + + 1. Calculate the new average value for each ARN with the latest count, weighting + the past more heavily than the current hour. It does the same for the standard deviation—weighting + the past more heavily than the current.\ + + 1. Update the cache file with the latest results.\ + + 1. Set the minimum threshold for the number of data points and the number of standard + deviations away from the mean it must be to be considered a spike.\ + + 1. Make a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and if the count + is a sufficient number of standard deviations away from the average.\ + + 1. Filter out anything that it determines is not a spike and returns the list of + ARNs to the main search. The main search subsequently gets the names of the deleted + S3 buckets, the number of unique API calls, and the total number of API calls for + each of these user ARNs.' +entities: + - user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the minimum number of data + points required to have a statistically significant amount of data to determine. + The `deviationThreshold` variable is the number of standard deviations away from + the mean that the value must be to be considered a spike. This search works best + when you run the "Baseline of S3 Bucket deletion activity by ARN" support search + once to create a baseline of previously seen S3 bucket-deletion activity. +id: a26fc0cf-2199-4fab-928d-4b13442ee871 +investigations: + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242 + name: AWS S3 Bucket details via bucketName + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: 446ec87a-85c6-40d4-b060-bea4498281d6 + name: Get All AWS Activity From IP Address + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 + name: Investigate AWS activities via region name + type: splunk +known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`, + the false positive rate may vary. Please modify this according the your environment. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 13 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - Credential Access + - Execution + nist: + - DE.DP + - DE.CM + - PR.AC +modification_date: '2018-11-27' +name: Detect Spike in S3 Bucket deletion +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_vpc_blocked_traffic_mltk.yml b/detections/spike_vpc_blocked_traffic_mltk.yml new file mode 100644 index 0000000000..47a4a72f4e --- /dev/null +++ b/detections/spike_vpc_blocked_traffic_mltk.yml @@ -0,0 +1,183 @@ +asset_type: AWS Instance +baselines: + - id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89 + name: Baseline of blocked outbound traffic from AWS - MLTK + type: splunk +confidence: medium +creation_date: '2018-04-26' +data_metadata: + data_source: + - AWS VPC Flow Logs + data_sourcetypes: + - aws:cloudwatchlogs:vpcflow + providing_technologies: + - AWS +description: This search will detect spike in blocked outbound network connections + originating from within your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: src_ip + rule_description: A spike in the blocked outbound connection is detected from + source $src_ip$. + rule_title: Spike in blocked outbound network connections from $src_ip$ detected. + risk: + risk_object: src_ip + risk_object_type: + - system + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8 + OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND + dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search sourcetype=aws:cloudwatchlogs:vpcflow + action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) + ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | + stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections + append=t | fields - latestCount | stats values(*) as * by src_ip | rename + numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections + + (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, + 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) + | eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), + stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), + numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table + src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections + | outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold + = 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip] + | stats values(dest_ip) as "Blocked Destination IPs", values(interface_id) + as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections + by src_ip + suppress: + suppress_fields: src_ip + suppress_period: 14400s +eli5: 'This search retrieves all the VPC Flow log entries that have recorded a blocked + outbound network connection originating from your AWS environment. Then it kicks + off a subsearch, which looks at the same data and performs the following series + of steps: \ + + 1. Counts the number of blocked outbound connections by each source IP\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the average blocked connections, and the standard deviation for + each source IP.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `numberOfBlockedConnections` as `latestCount`.\ + + 1. Calculates the new average value for each source IP with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation, weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + source IPs to the main search. The main search subsequently gets the list of all + destination IPs for which the traffic was blocked, the network interface ID, the + number of unique destination IP, and the total number of blocked connections for + each of these source IP addresses. Finally, it looks up the average and standard + deviation and returns both the average and the number of standard deviations the + spike is from the average.' +entities: + - src_ip +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow + logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the number of data points + required to meet the definition of "spike." The `deviationThreshold` variable is + the number of standard deviations away from the mean that the value must be to be + considered a spike. This search works best when you run the "Baseline of Blocked + Outbound Connection" support search once to create a history of previously seen + blocked outbound connections. +id: b1370336-450a-49e5-8c94-788136734a33 +investigations: + - id: 910e6512-edc9-4f93-ba24-5b786f47a672 + name: Get Process Responsible For The DNS Traffic + type: splunk + - id: 9925d08f-561e-4faa-8912-e3888a842341 + name: Get Process Information For Port Activity + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76 + name: Get Authentication Logs For Endpoint + type: splunk + - id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 + name: AWS Network Interface details via resourceId + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 + name: AWS Network ACL Details from ID + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 + name: Get DNS Server History for a host + type: splunk + - id: fdcfb369-1725-4c24-824a-22972d7f0d55 + name: Get Risk Modifiers For User + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 + name: Get Process Info + type: splunk + - id: 446ec87a-85c6-40d4-b060-bea4498281d6 + name: Get All AWS Activity From IP Address + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 + name: Get DNS traffic ratio + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: fdcfb369-1725-4c24-824a-22972d7f0d65 + name: Get Risk Modifiers For Endpoint + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk +known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` + and `deviationThreshold`. Additionally, false positives may result when AWS administrators + roll out policies enforcing network blocks, causing sudden increases in the number + of blocked outbound connections. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 11 + kill_chain_phases: + - Actions on Objectives + - Command and Control + mitre_attack: + - Exfiltration + - Command and Control + nist: + - DE.AE + - DE.CM + - PR.AC +modification_date: '2018-05-07' +name: Detect Spike in blocked Outbound Traffic from your AWS - MLTK +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_vpc_blocked_traffic_mltk.ymlbak b/detections/spike_vpc_blocked_traffic_mltk.ymlbak new file mode 100644 index 0000000000..a53de4f848 --- /dev/null +++ b/detections/spike_vpc_blocked_traffic_mltk.ymlbak @@ -0,0 +1,183 @@ +asset_type: AWS Instance +baselines: + - id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63 + name: Baseline of blocked outbound traffic from AWS + type: splunk +confidence: medium +creation_date: '2018-04-26' +data_metadata: + data_source: + - AWS VPC Flow Logs + data_sourcetypes: + - aws:cloudwatchlogs:vpcflow + providing_technologies: + - AWS +description: This search will detect spike in blocked outbound network connections + originating from within your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: src_ip + rule_description: A spike in the blocked outbound connection is detected from + source $src_ip$. + rule_title: Spike in blocked outbound network connections from $src_ip$ detected. + risk: + risk_object: src_ip + risk_object_type: + - system + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8 + OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND + dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search sourcetype=aws:cloudwatchlogs:vpcflow + action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) + ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | + stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections + append=t | fields - latestCount | stats values(*) as * by src_ip | rename + numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections + + (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, + 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) + | eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), + stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), + numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table + src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections + | outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold + = 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip] + | stats values(dest_ip) as "Blocked Destination IPs", values(interface_id) + as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections + by src_ip + suppress: + suppress_fields: src_ip + suppress_period: 14400s +eli5: 'This search retrieves all the VPC Flow log entries that have recorded a blocked + outbound network connection originating from your AWS environment. Then it kicks + off a subsearch, which looks at the same data and performs the following series + of steps: \ + + 1. Counts the number of blocked outbound connections by each source IP\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the average blocked connections, and the standard deviation for + each source IP.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `numberOfBlockedConnections` as `latestCount`.\ + + 1. Calculates the new average value for each source IP with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation, weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + source IPs to the main search. The main search subsequently gets the list of all + destination IPs for which the traffic was blocked, the network interface ID, the + number of unique destination IP, and the total number of blocked connections for + each of these source IP addresses. Finally, it looks up the average and standard + deviation and returns both the average and the number of standard deviations the + spike is from the average.' +entities: + - src_ip +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow + logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the number of data points + required to meet the definition of "spike." The `deviationThreshold` variable is + the number of standard deviations away from the mean that the value must be to be + considered a spike. This search works best when you run the "Baseline of Blocked + Outbound Connection" support search once to create a history of previously seen + blocked outbound connections. +id: ada0f278-84a8-46w1-a3f1-w32372d4bd53 +investigations: + - id: 910e6512-edc9-4f93-ba24-5b786f47a672 + name: Get Process Responsible For The DNS Traffic + type: splunk + - id: 9925d08f-561e-4faa-8912-e3888a842341 + name: Get Process Information For Port Activity + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76 + name: Get Authentication Logs For Endpoint + type: splunk + - id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 + name: AWS Network Interface details via resourceId + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 + name: AWS Network ACL Details from ID + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 + name: Get DNS Server History for a host + type: splunk + - id: fdcfb369-1725-4c24-824a-22972d7f0d55 + name: Get Risk Modifiers For User + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 + name: Get Process Info + type: splunk + - id: 446ec87a-85c6-40d4-b060-bea4498281d6 + name: Get All AWS Activity From IP Address + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 + name: Get DNS traffic ratio + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: fdcfb369-1725-4c24-824a-22972d7f0d65 + name: Get Risk Modifiers For Endpoint + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk +known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` + and `deviationThreshold`. Additionally, false positives may result when AWS administrators + roll out policies enforcing network blocks, causing sudden increases in the number + of blocked outbound connections. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 11 + kill_chain_phases: + - Actions on Objectives + - Command and Control + mitre_attack: + - Exfiltration + - Command and Control + nist: + - DE.AE + - DE.CM + - PR.AC +modification_date: '2018-05-07' +name: Detect Spike in blocked Outbound Traffic from your AWS +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/detections/spike_vpc_blocked_traffic_mltk.ymlbak2 b/detections/spike_vpc_blocked_traffic_mltk.ymlbak2 new file mode 100644 index 0000000000..17d1d0dc80 --- /dev/null +++ b/detections/spike_vpc_blocked_traffic_mltk.ymlbak2 @@ -0,0 +1,183 @@ +asset_type: AWS Instance +baselines: + - id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89 + name: Baseline of blocked outbound traffic from AWS + type: splunk +confidence: medium +creation_date: '2018-04-26' +data_metadata: + data_source: + - AWS VPC Flow Logs + data_sourcetypes: + - aws:cloudwatchlogs:vpcflow + providing_technologies: + - AWS +description: This search will detect spike in blocked outbound network connections + originating from within your AWS environment. It will also update the cache file + that factors in the latest data. +detect: + splunk: + correlation_rule: + notable: + nes_fields: src_ip + rule_description: A spike in the blocked outbound connection is detected from + source $src_ip$. + rule_title: Spike in blocked outbound network connections from $src_ip$ detected. + risk: + risk_object: src_ip + risk_object_type: + - system + risk_score: 30 + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8 + OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND + dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search sourcetype=aws:cloudwatchlogs:vpcflow + action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) + ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | + stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections + append=t | fields - latestCount | stats values(*) as * by src_ip | rename + numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections + + (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, + 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) + | eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), + stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), + numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table + src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections + | outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold + = 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) + AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip] + | stats values(dest_ip) as "Blocked Destination IPs", values(interface_id) + as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections + by src_ip + suppress: + suppress_fields: src_ip + suppress_period: 14400s +eli5: 'This search retrieves all the VPC Flow log entries that have recorded a blocked + outbound network connection originating from your AWS environment. Then it kicks + off a subsearch, which looks at the same data and performs the following series + of steps: \ + + 1. Counts the number of blocked outbound connections by each source IP\ + + 1. Loads the cache file that contains the number of data points, the count from + the latest hour, the average blocked connections, and the standard deviation for + each source IP.\ + + 1. Drops the count from the latest hour, since it is not necessary, and merges the + rest of the data with the results of the stats command. \ + + 1. Renames `numberOfBlockedConnections` as `latestCount`.\ + + 1. Calculates the new average value for each source IP with the latest count, weighting + the past much more heavily than the current hour. It does the same for the standard + deviation, weighting the past more heavily than the current.\ + + 1. Updates the cache file with the latest results.\ + + 1. Sets the minimum threshold for the number of data points and sets the number + of standard deviations away from the mean it must be to be considered a spike.\ + + 1. Makes a determination regarding whether or not the current count is a spike by + checking to see if the minimum data-point threshold has been met and the count is + a sufficient number of standard deviations away from the average.\ + + 1. Filters out anything that it determines is not a spike and returns the list of + source IPs to the main search. The main search subsequently gets the list of all + destination IPs for which the traffic was blocked, the network interface ID, the + number of unique destination IP, and the total number of blocked connections for + each of these source IP addresses. Finally, it looks up the average and standard + deviation and returns both the average and the number of standard deviations the + spike is from the average.' +entities: + - src_ip +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow + logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit + your environment. The `dataPointThreshold` variable is the number of data points + required to meet the definition of "spike." The `deviationThreshold` variable is + the number of standard deviations away from the mean that the value must be to be + considered a spike. This search works best when you run the "Baseline of Blocked + Outbound Connection" support search once to create a history of previously seen + blocked outbound connections. +id: b1370336-450a-49e5-8c94-788136734a33 +investigations: + - id: 910e6512-edc9-4f93-ba24-5b786f47a672 + name: Get Process Responsible For The DNS Traffic + type: splunk + - id: 9925d08f-561e-4faa-8912-e3888a842341 + name: Get Process Information For Port Activity + type: splunk + - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + name: AWS Investigate User Activities By ARN + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76 + name: Get Authentication Logs For Endpoint + type: splunk + - id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 + name: AWS Network Interface details via resourceId + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 + name: AWS Network ACL Details from ID + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 + name: Get DNS Server History for a host + type: splunk + - id: fdcfb369-1725-4c24-824a-22972d7f0d55 + name: Get Risk Modifiers For User + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 + name: Get Process Info + type: splunk + - id: 446ec87a-85c6-40d4-b060-bea4498281d6 + name: Get All AWS Activity From IP Address + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 + name: Get DNS traffic ratio + type: splunk + - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 + name: Get Notable History + type: splunk + - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242 + name: Get Notable Info + type: splunk + - id: fdcfb369-1725-4c24-824a-22972d7f0d65 + name: Get Risk Modifiers For Endpoint + type: splunk + - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74 + name: Get User Information from Identity Table + type: splunk +known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` + and `deviationThreshold`. Additionally, false positives may result when AWS administrators + roll out policies enforcing network blocks, causing sudden increases in the number + of blocked outbound connections. +maintainers: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +mappings: + cis20: + - CIS 11 + kill_chain_phases: + - Actions on Objectives + - Command and Control + mitre_attack: + - Exfiltration + - Command and Control + nist: + - DE.AE + - DE.CM + - PR.AC +modification_date: '2018-05-07' +name: Detect Spike in blocked Outbound Traffic from your AWS +original_authors: + - company: Splunk + email: bpatel@splunk.com + name: Bhavin Patel +references: [] +security_domain: network +spec_version: 2 +type: splunk +version: '1.0' diff --git a/throwAwaySubs.sed b/throwAwaySubs.sed new file mode 100644 index 0000000000..bc0baa7bce --- /dev/null +++ b/throwAwaySubs.sed @@ -0,0 +1,20 @@ +s/fc0edc96-ff2b-48b0-9f6f-63da3783fd63/ee7dfb8b-fc3b-44d0-812e-0be53ee060d0/g +s/fc0edd96-ff2b-48b0-9f1f-63da3782fd63/8141a8f9-540f-45c7-8d6d-c5ac502afa89/g +s/fc0edd96-ff2b-4810-9f1f-63da3783fd63/f4bc7f4b-9bce-44d8-82eb-ada06f6b493f/g +s/fc0edd96-ff2b-48b0-9f1f-63eq3783fd63/5c577fec-61f2-4d38-bae5-c605173fa671/g +s/fc0edd96-ff2b-48b0-9f1f-63da3783fd63/765b3857-8d79-475f-8b21-2bea774cd641/g +s/ada0f478-84a8-4641-a1f1-e32372d4bd53/c7bc51d2-330e-46da-a2e6-070909a602de/g +s/ada0f478-84a8-4641-a3f1-d32362d4bd55/06bf47d6-c47a-4a84-a491-d2857b542e67/g +s/ada0f478-84a8-4641-a3f1-e32372d4bd53/f0a6dda0-a5b2-4b30-977d-ac1b063b8820/g +s/ad12w478-84a8-4641-a3w1-e32372q4bd53/a26fc0cf-2199-4fab-928d-4b13442ee871/g +s/ada0f278-84a8-46w1-a3f1-w32372d4bd53/b1370336-450a-49e5-8c94-788136734a33/g +s/name: Baseline of API Calls per User ARN/name: Baseline of API Calls per User ARN - MLTK/g +s/name: Baseline of blocked outbound traffic from AWS/name: Baseline of blocked outbound traffic from AWS - MLTK/g +s/name: Baseline of Network ACL Activity by ARN/name: Baseline of Network ACL Activity by ARN - MLTK/g +s/name: Baseline of S3 Bucket deletion activity by ARN/name: Baseline of S3 Bucket deletion activity by ARN - MLTK/g +s/name: Baseline of Security Group Activity by ARN/name: Baseline of Security Group Activity by ARN - MLTK/g +s/name: Detect Spike in Network ACL Activity/name: Detect Spike in Network ACL Activity - MLTK/g +s/name: Detect Spike in AWS API Activity/name: Detect Spike in AWS API Activity - MLTK/g +s/name: Detect Spike in Security Group Activity/name: Detect Spike in Security Group Activity - MLTK/g +s/name: Detect Spike in S3 Bucket deletion/name: Detect Spike in S3 Bucket deletion - MLTK/g +s/name: Detect Spike in blocked Outbound Traffic from your AWS/name: Detect Spike in blocked Outbound Traffic from your AWS - MLTK/g