Branch was auto-updated.

detections/cloud/aws_defense_evasion_delete_cloudtrail.yml

@@ -0,0 +1,64 @@
+name: AWS Defense Evasion Delete Cloudtrail
+id: 82092925-9ca1-4e06-98b8-85a2d3889552
+version: 1
+date: '2022-07-13'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: This analytic identifies AWS `DeleteTrail` events within CloudTrail logs. Adversaries often try to impair their target's defenses by stopping their malicious activity from being logged, so that they may operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they may delete the the entire cloudtrail that is logging activities in the environment. 
+search: '`cloudtrail` eventName = DeleteTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudtrail_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in
+  your AWS Environment.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has stopped cloudTrail logging. Please investigate this activity. 
+references:
+- https://attack.mitre.org/techniques/T1562/008/
+tags:
+  analytic_story:
+  - AWS Defense Evasion
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has delete a CloudTrail logging for account id $aws_account_id$ from IP $src$
+  mitre_attack_id:
+  - T1562.008
+  - T1562
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - requestParameters.name
+  - userAgent
+  - aws_account_id
+  - src
+  - region
+  risk_score: 90
+  security_domain: threat
+

detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml

@@ -0,0 +1,65 @@
+name: AWS Defense Evasion Delete CloudWatch Log Group
+id: d308b0f1-edb7-4a62-a614-af321160710f
+version: 1
+date: '2022-07-17'
+author: Gowthamaraj Rajendran, Splunk
+type: TTP
+datamodel: []
+description: This analytic identifies AWS `DeleteLogGroup` events in CloudTrail logs. Attackers may evade the logging capability by deleting the log group in CloudWatch. 
+  This will stop sending the logs and metrics to CloudWatch. When the adversary has the right type of permissions within the compromised AWS environment, 
+  they may delete the CloudWatch log group that is logging activities in the environment.
+search: '`cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.logGroupName) as log_group_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudwatch_log_group_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in
+  your AWS Environment.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has deleted CloudWatch logging. Please investigate this activity. 
+references:
+- https://attack.mitre.org/techniques/T1562/008/
+tags:
+  analytic_story:
+  - AWS Defense Evasion
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has deleted a CloudWatch logging group for account id $aws_account_id$ from IP $src$
+  mitre_attack_id:
+  - T1562
+  - T1562.008
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - requestParameters.name
+  - userAgent
+  - aws_account_id
+  - src
+  - region
+  risk_score: 90
+  security_domain: threat

detections/cloud/aws_defense_evasion_impair_security_services.yml

@@ -0,0 +1,65 @@
+name: AWS Defense Evasion Impair Security Services
+id: b28c4957-96a6-47e0-a965-6c767aac1458
+version: 1
+date: '2022-07-26'
+author: Bhavin Patel, Gowthamaraj Rajendran, Splunk
+type: Hunting
+datamodel: []
+description: This analytic looks for several delete specific API calls made to AWS Security Services like CloudWatch, GuardDuty and Web Application Firewalls. These API calls are often leveraged by adversaries to weaken existing security defenses by deleting logging configurations in the CloudWatch alarm, delete a set of detectors from your Guardduty environment or simply delete a bunch of CloudWatch alarms to remain stealthy and avoid detection.
+search: '`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") | stats
+  count min(_time) as firstTime max(_time) as lastTime values(eventName)  as eventName values(eventSource) as eventSource values(requestParameters.*) as * by src region user_arn aws_account_id user_type user_agent errorCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|  `aws_defense_evasion_impair_security_services_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in
+  your AWS Environment.
+known_false_positives: While this search has no known false positives, it is possible
+  that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
+references:
+- https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html
+- https://docs.aws.amazon.com/cli/latest/reference/waf/index.html
+- https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
+tags:
+  analytic_story:
+  - AWS Defense Evasion
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events.json
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has made potentially risky api calls $eventName$ that could impair AWS security services for account id $aws_account_id$
+  mitre_attack_id:
+  - T1562.008
+  - T1562
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - user_agent
+  - user_type
+  - aws_account_id
+  - src
+  - region
+  - errorCode
+  risk_score: 42
+  security_domain: threat

detections/cloud/aws_defense_evasion_putbucketlifecycle.yml

@@ -0,0 +1,68 @@
+name: AWS Defense Evasion PutBucketLifecycle
+id: ce1c0e2b-9303-4903-818b-0d9002fc6ea4
+version: 1
+date: '2022-07-25'
+author: Bhavin Patel
+type: Hunting
+datamodel: []
+description: This analytic identifies `PutBucketLifecycle` events in CloudTrail logs where a user has created a new lifecycle rule for an S3 bucket with a short expiration period. Attackers may use this API call to impair the CloudTrail logging by removing logs from the S3 bucket by changing the object expiration day to 1 day, in which case the CloudTrail logs will be deleted.
+search: '`cloudtrail` eventName=PutBucketLifecycle user_type=IAMUser errorCode=success
+|  spath path=requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days output=expiration_days
+|  spath path=requestParameters{}.bucketName output=bucket_name
+| stats
+  count min(_time) as firstTime max(_time) as lastTime  by src region eventName userAgent user_arn aws_account_id expiration_days  bucket_name user_type| `security_content_ctime(firstTime)` 
+|  `security_content_ctime(lastTime)` | where expiration_days < 3 | `aws_defense_evasion_putbucketlifecycle_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in
+  your AWS Environment. We recommend our users to set the expiration days value according to your company's log retention policies. 
+known_false_positives: While this search has no known false positives, it is possible
+  that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
+references:
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/
+tags:
+  analytic_story:
+  - AWS Defense Evasion
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 40
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events.json
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has created a new rule to on an S3 bucket $bucket_name$ with short expiration days
+  mitre_attack_id:
+  - T1562.008
+  - T1562
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - requestParameters.name
+  - userAgent
+  - aws_account_id
+  - src
+  - region
+  - requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days
+  - requestParameters{}.bucketName
+  risk_score: 20
+  security_domain: threat

detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml

@@ -0,0 +1,63 @@
+name: AWS Defense Evasion Stop Logging Cloudtrail
+id: 8a2f3ca2-4eb5-4389-a549-14063882e537
+version: 1
+date: '2022-07-12'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: This analytic identifies `StopLogging` events in CloudTrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they may operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they may easily stop logging. 
+search: '`cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as stopped_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `aws_defense_evasion_stop_logging_cloudtrail_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
+  your AWS Environment.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has stopped cloudtrail logging. Please investigate this activity. 
+references:
+- https://attack.mitre.org/techniques/T1562/008/
+tags:
+  analytic_story:
+  - AWS Defense Evasion
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has stopped Cloudtrail logging for account id $aws_account_id$ from IP $src$
+  mitre_attack_id:
+  - T1562.008
+  - T1562
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - requestParameters.name
+  - userAgent
+  - aws_account_id
+  - src
+  - region
+  risk_score: 90
+  security_domain: threat

detections/cloud/aws_defense_evasion_update_cloudtrail.yml

@@ -0,0 +1,66 @@
+name: AWS Defense Evasion Update Cloudtrail
+id: 7c921d28-ef48-4f1b-85b3-0af8af7697db
+version: 1
+date: '2022-07-17'
+author: Gowthamaraj Rajendran, Splunk
+type: TTP
+datamodel: []
+description: This analytic identifies `UpdateTrail` events in CloudTrail logs. Attackers may evade the logging capability by updating the settings and impairing 
+  them with wrong parameters. For example, Attackers may change the multi-regional log into a single region logs, which evades the logging for other regions. 
+  When the adversary has the right type of permissions in the compromised AWS environment, they may update the CloudTrail settings that is logging activities 
+  in your environment.
+search: '`cloudtrail` eventName = UpdateTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `aws_defense_evasion_update_cloudtrail_filter`'
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in
+  your AWS Environment.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has updated cloudtrail logging. Please investigate this activity. 
+references:
+- https://attack.mitre.org/techniques/T1562/008/
+tags:
+  analytic_story:
+  - AWS Defense Evasion
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has updated a cloudtrail logging for account id $aws_account_id$ from IP $src$
+  mitre_attack_id:
+  - T1562
+  - T1562.008
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - eventName
+  - eventSource
+  - requestParameters.name
+  - userAgent
+  - aws_account_id
+  - src
+  - region
+  risk_score: 90
+  security_domain: threat

detections/endpoint/any_powershell_downloadfile.yml

@@ -35,6 +35,7 @@ tags:
   - Malicious PowerShell
   - Ingress Tool Transfer
   - Log4Shell CVE-2021-44228
+  - DarkCrystal RAT
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -43,6 +43,7 @@ tags:
   - Hermetic Wiper
   - Industroyer2
   - Azorult
+  - DarkCrystal RAT
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -44,6 +44,7 @@ tags:
   - Malicious PowerShell
   - NOBELIUM Group
   - WhisperGate
+  - DarkCrystal RAT
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - HAFNIUM Group
+  - DarkCrystal RAT
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/office_document_executing_macro_code.yml

@@ -30,6 +30,7 @@ tags:
   - Spearphishing Attachments
   - Trickbot
   - IcedID
+  - DarkCrystal RAT
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Trickbot
+  - DarkCrystal RAT
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -1,14 +1,15 @@
 name: Registry Keys Used For Persistence
 id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
-version: 7
-date: '2022-01-26'
+version: 8
+date: '2022-07-20'
 author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry
   where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
   OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
@@ -23,18 +24,13 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
   AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session
   Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run"
-  AND Registry.registry_key_name="auto_update")) by _time span=1h Registry.dest Registry.user
+  AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user
   Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)`
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
-  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
-  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
-  proc_guid | fields _time dest user parent_process_name parent_process process_name
-  process_path process proc_guid registry_path registry_value_name registry_value_data
-  registry_key_name] | table _time dest user parent_process_name parent_process process_name
-  process_path process proc_guid registry_path registry_value_name registry_value_data
-  registry_key_name | `registry_keys_used_for_persistence_filter`'
+  Registry.process_guid Registry.registry_key_name  
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `registry_keys_used_for_persistence_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
@@ -66,7 +62,7 @@ tags:
   - Stage:Persistence
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log
-  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log
+  - https://media.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives

detections/endpoint/suspicious_process_file_path.yml

@@ -39,6 +39,7 @@ tags:
   - WhisperGate
   - Hermetic Wiper
   - Industroyer2
+  - DarkCrystal RAT
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/winword_spawning_cmd.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - DarkCrystal RAT
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/winword_spawning_powershell.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - DarkCrystal RAT
   confidence: 100
   context:
   - Source:Endpoint

docs/CNAME

@@ -1 +0,0 @@
-research.splunk.com

docs/Gemfile.lock

@@ -251,12 +251,12 @@ GEM
       jekyll-seo-tag (~> 2.1)
     minitest (5.15.0)
     multipart-post (2.1.1)
-    nokogiri (1.13.4)
+    nokogiri (1.13.7)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
-    nokogiri (1.13.4-x86_64-darwin)
+    nokogiri (1.13.7-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.13.4-x86_64-linux)
+    nokogiri (1.13.7-x86_64-linux)
       racc (~> 1.4)
     octokit (4.22.0)
       faraday (>= 0.9)

stories/aws_defense_evasion.yml

@@ -0,0 +1,25 @@
+name: AWS Defense Evasion
+id: 4e00b690-293f-434d-a9d8-bcfb2ea5fff9
+version: 1
+date: '2022-07-15'
+author: Gowthamaraj Rajendran, Splunk
+description: Identify activity and techniques associated with the Evasion of
+  Defenses within AWS, such as Disabling CloudTrail, Deleting CloudTrail and many others.
+narrative: Adversaries employ a variety of techniques in order to avoid detection and operate
+  without barriers. This often involves modifying the configuration of security monitoring tools
+  to get around them or explicitly disabling them to prevent them from running. This
+  Analytic Story includes analytics that identify activity consistent with adversaries
+  attempting to disable various security mechanisms on AWS. Such activity may involve deleting the CloudTrail logs , 
+  as this is where all the AWS logs get stored or explicitly changing the retention policy of S3 buckets.
+  Other times, adversaries attempt deletion of a specified AWS CloudWatch log group.
+references:
+- https://attack.mitre.org/tactics/TA0005/
+tags:
+  analytic_story: AWS Defense Evasion
+  category:
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

stories/darkcrystal_rat.yml

@@ -0,0 +1,24 @@
+name: DarkCrystal RAT
+id: 639e6006-0885-4847-9394-ddc2902629bf
+version: 1
+date: '2022-07-26'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc.
+  The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest 
+  commercial RATs. 
+  DcRat is modular and bespoke plugin framework make it a very flexible option, helpful for a range of nefearious uses.
+narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption
+  is the goal. 
+references:
+- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
+tags:
+  analytic_story: DarkCrystal RAT
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml

@@ -0,0 +1,12 @@
+name: AWS Defense Evasion Delete Cloudtrail Unit Test
+tests:
+- name: AWS Defense Evasion Delete Cloudtrail
+  file: cloud/aws_defense_evasion_delete_cloudtrail.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail

tests/cloud/aws_defense_evasion_delete_cloudwatch_log_group.test.yml

@@ -0,0 +1,13 @@
+name: AWS Defense Evasion Delete CloudWatch Log Group Unit Test
+tests:
+- name: AWS Defense Evasion Delete CloudWatch Log Group
+  file: cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true

tests/cloud/aws_defense_evasion_impair_security_services.test.yml

@@ -0,0 +1,13 @@
+name: AWS Defense Evasion Impair Security Services Unit Test
+tests:
+- name: AWS Defense Evasion Impair Security Services
+  file: cloud/aws_defense_evasion_impair_security_services.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/aws_defense_evasion_putbucketlifecycle.test.yml

@@ -0,0 +1,13 @@
+name: AWS Defense Evasion PutBucketLifecycle Unit Test
+tests:
+- name: AWS Defense Evasion PutBucketLifecycle
+  file: cloud/aws_defense_evasion_putbucketlifecycle.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true

tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml

@@ -0,0 +1,12 @@
+name: AWS Defense Evasion Stop Logging Cloudtrail Unit Test
+tests:
+- name: AWS Defense Evasion Stop Logging Cloudtrail
+  file: cloud/aws_defense_evasion_stop_logging_cloudtrail.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail

tests/cloud/aws_defense_evasion_update_cloudtrail.test.yml

@@ -0,0 +1,13 @@
+name: AWS Defense Evasion Update Cloudtrail Unit Test
+tests:
+- name: AWS Defense Evasion Update Cloudtrail
+  file: cloud/aws_defense_evasion_update_cloudtrail.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true