From 9756e681f798d12058e068e2bbf8d3c49c451487 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Jul 2022 17:47:58 -0700 Subject: [PATCH 01/17] aws cloudtrail stop logging --- ...efense_evasion_stop_logging_cloudtrail.yml | 62 +++++++++++++++++++ ...e_evasion_stop_logging_cloudtrail.test.yml | 13 ++++ 2 files changed, 75 insertions(+) create mode 100644 detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml create mode 100644 tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml new file mode 100644 index 0000000000..ad4edee68f --- /dev/null +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -0,0 +1,62 @@ +name: AWS Defense Evasion Stop Logging Cloudtrail +id: 8a2f3ca2-4eb5-4389-a549-14063882e537 +version: 1 +date: '2022-07-12' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +description: This search looks for `StopLogging` events in Cloudtrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they can operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they can easily stop logging. +search: '`cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as stopped_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `aws_defense_evasion_stop_logging_cloudtrail_filter`' +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in + your AWS Environment. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has stopped cloudtrail logging. Please investigate this activity. +references: +- https://attack.mitre.org/techniques/T1562/008/ +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_cloudtrail_logging/aws_cloudtrail_events.json + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: + mitre_attack_id: + - T1562.008 + - T1562 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - requestParameters.name + - userAgent + - aws_account_id + - src + - region + risk_score: 90 + security_domain: threat diff --git a/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml b/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml new file mode 100644 index 0000000000..21966efbc8 --- /dev/null +++ b/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml @@ -0,0 +1,13 @@ +name: AWS Defense Evasion Stop Logging Cloudtrail Unit Test +tests: +- name: AWS Defense Evasion Stop Logging Cloudtrail + file: cloud/aws_defense_evasion_stop_logging_cloudtrail.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_cloudtrail_logging/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 92d6b653bcdf1757a856e5d4afd8d2085fa5c207 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Jul 2022 17:50:38 -0700 Subject: [PATCH 02/17] mionr --- .../cloud/aws_defense_evasion_stop_logging_cloudtrail.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index ad4edee68f..524c75cd55 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -7,7 +7,8 @@ type: TTP datamodel: [] description: This search looks for `StopLogging` events in Cloudtrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they can operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they can easily stop logging. search: '`cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats - count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as stopped_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `aws_defense_evasion_stop_logging_cloudtrail_filter`' + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as stopped_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `aws_defense_evasion_stop_logging_cloudtrail_filter`' how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible @@ -16,7 +17,7 @@ references: - https://attack.mitre.org/techniques/T1562/008/ tags: analytic_story: - - UPDATE_STORY_NAME + - AWS Defense Evasion asset_type: AWS Account cis20: - CIS 3 From 0c7efe362c9e528c9e289e7b4013a6d35ed9b271 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Jul 2022 18:27:39 -0700 Subject: [PATCH 03/17] message --- .../cloud/aws_defense_evasion_stop_logging_cloudtrail.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index 524c75cd55..88a1f9ad99 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -31,7 +31,7 @@ tags: impact: 100 kill_chain_phases: - Actions on Objectives - message: + message: User $user_arn$ has stopped Cloudtrail logging for account id $aws_account_id$ from IP $src$ mitre_attack_id: - T1562.008 - T1562 From c0996437b56053696033a6b1eb8bab62222d89e1 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 13 Jul 2022 11:40:55 -0700 Subject: [PATCH 04/17] remove update --- .../cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml b/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml index 21966efbc8..2d28024417 100644 --- a/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml +++ b/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml @@ -9,5 +9,4 @@ tests: - file_name: aws_cloudtrail_events.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_cloudtrail_logging/aws_cloudtrail_events.json sourcetype: aws:cloudtrail - source: aws_cloudtrail - update_timestamp: true + source: aws_cloudtrail \ No newline at end of file From 5bf8a69beb9e834c99d132f4c2ad330e368d8cb0 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 13 Jul 2022 12:49:43 -0700 Subject: [PATCH 05/17] delete cloudtrail --- .../aws_defense_evasion_delete_cloudtrail.yml | 64 +++++++++++++++++++ ...efense_evasion_stop_logging_cloudtrail.yml | 2 +- ...defense_evasion_delete_cloudtrail.test.yml | 13 ++++ ...e_evasion_stop_logging_cloudtrail.test.yml | 2 +- 4 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/aws_defense_evasion_delete_cloudtrail.yml create mode 100644 tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml diff --git a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml new file mode 100644 index 0000000000..4a4b47d560 --- /dev/null +++ b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml @@ -0,0 +1,64 @@ +name: AWS Defense Evasion Delete Cloudtrail +id: 82092925-9ca1-4e06-98b8-85a2d3889552 +version: 1 +date: '2022-07-13' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +description: This search looks for `DeleteTrail` events in Cloudtrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they can operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they can delete the the entire cloudtrail that is logging activities in your environment. +search: '`cloudtrail` eventName = DeleteTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudtrail_filter`' +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in + your AWS Environment. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has stopped cloudtrail logging. Please investigate this activity. +references: +- https://attack.mitre.org/techniques/T1562/008/ +tags: + analytic_story: + - AWS Defense Evasion + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: User $user_arn$ has delete a cloudtrail logging for account id $aws_account_id$ from IP $src$ + mitre_attack_id: + - T1562.008 + - T1562 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - requestParameters.name + - userAgent + - aws_account_id + - src + - region + risk_score: 90 + security_domain: threat + diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index 88a1f9ad99..b5d0b88c7a 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -27,7 +27,7 @@ tags: context: - Source:Cloud Data dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_cloudtrail_logging/aws_cloudtrail_events.json + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json impact: 100 kill_chain_phases: - Actions on Objectives diff --git a/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml b/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml new file mode 100644 index 0000000000..e0d00e0eb6 --- /dev/null +++ b/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml @@ -0,0 +1,13 @@ +name: AWS Defense Evasion Delete Cloudtrail Unit Test +tests: +- name: AWS Defense Evasion Delete Cloudtrail + file: cloud/aws_defense_evasion_delete_cloudtrail.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml b/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml index 2d28024417..f8a30976d9 100644 --- a/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml +++ b/tests/cloud/aws_defense_evasion_stop_logging_cloudtrail.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: aws_cloudtrail_events.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_cloudtrail_logging/aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail \ No newline at end of file From 4ea633033ab488902452755b60201994e860a208 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Fri, 15 Jul 2022 15:34:23 -0400 Subject: [PATCH 06/17] Create AWS defense evasion story --- stories/aws_defense_evasion.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 stories/aws_defense_evasion.yml diff --git a/stories/aws_defense_evasion.yml b/stories/aws_defense_evasion.yml new file mode 100644 index 0000000000..8b2f7ad5c7 --- /dev/null +++ b/stories/aws_defense_evasion.yml @@ -0,0 +1,25 @@ +name: AWS Defense Evasion +id: 4e00b690-293f-434d-a9d8-bcfb2ea5fff9 +version: 1 +date: '2022-07-15' +author: Gowthamaraj Rajendran, Splunk +description: Looks for activities and techniques associated with the Evasion of + Defenses on AWS Environment, such as Disabling cloud trail, Deleting cloud trail and many others. +narrative: Attackers employ a variety of tactics in order to avoid detection and operate + without barriers. This often involves modifying the configuration of security monitoring tools + to get around them or explicitly disabling them to prevent them from running. This + Analytic Story includes searches that look for activity consistent with attackers + attempting to disable various security mechanisms. Such activity may involve deleting the cloudtrail logs + , as this is where all the AWS logs get stored or explicitly changing the retention policy of s3 buckets. + Other times, attackers attempt deletion of a specified AWS CloudWatch log group. +references: +- https://attack.mitre.org/tactics/TA0005/ +tags: + analytic_story: AWS Defense Evasion + category: + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring From c2decc3b9c5c8ee1c3c1c82674bab15554409d98 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Tue, 19 Jul 2022 11:56:41 -0400 Subject: [PATCH 07/17] Add AWS defense evasion 1. Update Cloudtrail 2. Delete CloudWatch log group --- ...se_evasion_delete_cloudwatch_log_group.yml | 64 ++++++++++++++++++ .../aws_defense_evasion_update_cloudtrail.yml | 65 +++++++++++++++++++ ...asion_delete_cloudwatch_log_group.test.yml | 13 ++++ ...defense_evasion_update_cloudtrail.test.yml | 13 ++++ 4 files changed, 155 insertions(+) create mode 100644 detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml create mode 100644 detections/cloud/aws_defense_evasion_update_cloudtrail.yml create mode 100644 tests/cloud/aws_defense_evasion_delete_cloudwatch_log_group.test.yml create mode 100644 tests/cloud/aws_defense_evasion_update_cloudtrail.test.yml diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml new file mode 100644 index 0000000000..1d868fb74c --- /dev/null +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -0,0 +1,64 @@ +name: AWS Defense Evasion Delete CloudWatch Log Group +id: d308b0f1-edb7-4a62-a614-af321160710f +version: 1 +date: '2022-07-17' +author: Gowthamaraj Rajendran, Splunk +type: TTP +datamodel: [] +description: This search looks for `DeleteLogGroup` events in Cloudtrail logs. Attackers can evade the logging capability by deleting the log group in cloudwatch. + This will stop sending the lops and metrics to CloudWatch. When the adversary has the right type of permissions in the compromised AWS environment, + they can delete the CloudWatch log group that is logging activities in your environment. +search: '`cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudwatch_log_group_filter`' +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in + your AWS Environment. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has deleted CloudWatch logging. Please investigate this activity. +references: +- REFERENCE +tags: + analytic_story: + - AWS Defense Evasion + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events.json + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: User $user_arn$ has deleted a CloudWatch logging group for account id $aws_account_id$ from IP $src$ + mitre_attack_id: + - T1562.008 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - requestParameters.name + - userAgent + - aws_account_id + - src + - region + risk_score: 90 + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml new file mode 100644 index 0000000000..142880d173 --- /dev/null +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -0,0 +1,65 @@ +name: AWS Defense Evasion Update Cloudtrail +id: 7c921d28-ef48-4f1b-85b3-0af8af7697db +version: 1 +date: '2022-07-17' +author: Gowthamaraj Rajendran, Splunk +type: TTP +datamodel: [] +description: This search looks for `UpdateTrail` events in Cloudtrail logs. Attackers can evade the logging capability by updating the settings and impairing + them with wrong parameters. For example, Attackers can change the multi-regional log into a single region logs, which evades the logging for other regions. + When the adversary has the right type of permissions in the compromised AWS environment, they can update the cloudtrail settings that is logging activities + in your environment. +search: '`cloudtrail` eventName = UpdateTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `aws_defense_evasion_update_cloudtrail_filter`' +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in + your AWS Environment. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has updated cloudtrail logging. Please investigate this activity. +references: +- REFERENCE +tags: + analytic_story: + - AWS Defense Evasion + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events.json + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: User $user_arn$ has updated a cloudtrail logging for account id $aws_account_id$ from IP $src$ + mitre_attack_id: + - T1562.008 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - requestParameters.name + - userAgent + - aws_account_id + - src + - region + risk_score: 90 + security_domain: threat diff --git a/tests/cloud/aws_defense_evasion_delete_cloudwatch_log_group.test.yml b/tests/cloud/aws_defense_evasion_delete_cloudwatch_log_group.test.yml new file mode 100644 index 0000000000..416c1bf83f --- /dev/null +++ b/tests/cloud/aws_defense_evasion_delete_cloudwatch_log_group.test.yml @@ -0,0 +1,13 @@ +name: AWS Defense Evasion Delete CloudWatch Log Group Unit Test +tests: +- name: AWS Defense Evasion Delete CloudWatch Log Group + file: cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true diff --git a/tests/cloud/aws_defense_evasion_update_cloudtrail.test.yml b/tests/cloud/aws_defense_evasion_update_cloudtrail.test.yml new file mode 100644 index 0000000000..fddcb3d10b --- /dev/null +++ b/tests/cloud/aws_defense_evasion_update_cloudtrail.test.yml @@ -0,0 +1,13 @@ +name: AWS Defense Evasion Update Cloudtrail Unit Test +tests: +- name: AWS Defense Evasion Update Cloudtrail + file: cloud/aws_defense_evasion_update_cloudtrail.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true From 56364e9e05fa5cc79ddfa7ded134e5d2662b734d Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Tue, 19 Jul 2022 12:21:01 -0400 Subject: [PATCH 08/17] Update References --- .../cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml | 3 ++- detections/cloud/aws_defense_evasion_update_cloudtrail.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index 1d868fb74c..8bcb71bbbc 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -16,7 +16,7 @@ how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity. references: -- REFERENCE +- https://attack.mitre.org/techniques/T1562/008/ tags: analytic_story: - AWS Defense Evasion @@ -35,6 +35,7 @@ tags: - Actions on Objectives message: User $user_arn$ has deleted a CloudWatch logging group for account id $aws_account_id$ from IP $src$ mitre_attack_id: + - T1562 - T1562.008 nist: - DE.CM diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index 142880d173..33c2278808 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -17,7 +17,7 @@ how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity. references: -- REFERENCE +- https://attack.mitre.org/techniques/T1562/008/ tags: analytic_story: - AWS Defense Evasion @@ -36,6 +36,7 @@ tags: - Actions on Objectives message: User $user_arn$ has updated a cloudtrail logging for account id $aws_account_id$ from IP $src$ mitre_attack_id: + - T1562 - T1562.008 nist: - DE.CM From 21172c6ede71927026285dbe86b4287ba8d0f2f3 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Tue, 19 Jul 2022 15:08:43 -0400 Subject: [PATCH 09/17] update SPL --- .../cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml | 2 +- detections/cloud/aws_defense_evasion_update_cloudtrail.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index 8bcb71bbbc..8bbc93d5fd 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -9,7 +9,7 @@ description: This search looks for `DeleteLogGroup` events in Cloudtrail logs. A This will stop sending the lops and metrics to CloudWatch. When the adversary has the right type of permissions in the compromised AWS environment, they can delete the CloudWatch log group that is logging activities in your environment. search: '`cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats - count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.logGroupName) as log_group_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudwatch_log_group_filter`' how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index 33c2278808..987e958ae3 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -10,7 +10,7 @@ description: This search looks for `UpdateTrail` events in Cloudtrail logs. Atta When the adversary has the right type of permissions in the compromised AWS environment, they can update the cloudtrail settings that is logging activities in your environment. search: '`cloudtrail` eventName = UpdateTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats - count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_update_cloudtrail_filter`' how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. From 8d301459f85b492f68902bd32332e17f22ccdeb6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Jul 2022 19:36:18 +0000 Subject: [PATCH 10/17] Bump nokogiri from 1.13.4 to 1.13.7 in /docs Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.4 to 1.13.7. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.4...v1.13.7) --- updated-dependencies: - dependency-name: nokogiri dependency-type: indirect ... Signed-off-by: dependabot[bot] --- docs/Gemfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock index 11c0c4f1fe..7d8aa9f01b 100644 --- a/docs/Gemfile.lock +++ b/docs/Gemfile.lock @@ -251,12 +251,12 @@ GEM jekyll-seo-tag (~> 2.1) minitest (5.15.0) multipart-post (2.1.1) - nokogiri (1.13.4) + nokogiri (1.13.7) mini_portile2 (~> 2.8.0) racc (~> 1.4) - nokogiri (1.13.4-x86_64-darwin) + nokogiri (1.13.7-x86_64-darwin) racc (~> 1.4) - nokogiri (1.13.4-x86_64-linux) + nokogiri (1.13.7-x86_64-linux) racc (~> 1.4) octokit (4.22.0) faraday (>= 0.9) From 2a2fd8b6f55b9088452d78bccbf7812afa21093a Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 20 Jul 2022 11:10:15 +0200 Subject: [PATCH 11/17] fix-git-issue-req --- .../registry_keys_used_for_persistence.yml | 26 ++++++++----------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c1abc8b1f7..a9047c9439 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,14 +1,15 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 7 -date: '2022-01-26' +version: 8 +date: '2022-07-20' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk type: TTP datamodel: - Endpoint description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* @@ -23,18 +24,13 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" - AND Registry.registry_key_name="auto_update")) by _time span=1h Registry.dest Registry.user + AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `registry_keys_used_for_persistence_filter`' + Registry.process_guid Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -66,7 +62,7 @@ tags: - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log + - https://media.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log impact: 80 kill_chain_phases: - Actions on Objectives From 7eea768cde42826ae7203492eb80b4f7218bdd2a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 25 Jul 2022 16:29:57 -0700 Subject: [PATCH 12/17] new detection putbucket lifecycle --- ...aws_defense_evasion_putbucketlifecycle.yml | 68 +++++++++++++++++++ ...defense_evasion_delete_cloudtrail.test.yml | 1 - ...efense_evasion_putbucketlifecycle.test.yml | 13 ++++ 3 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/aws_defense_evasion_putbucketlifecycle.yml create mode 100644 tests/cloud/aws_defense_evasion_putbucketlifecycle.test.yml diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml new file mode 100644 index 0000000000..0f6c2ddb2b --- /dev/null +++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml @@ -0,0 +1,68 @@ +name: AWS Defense Evasion PutBucketLifecycle +id: ce1c0e2b-9303-4903-818b-0d9002fc6ea4 +version: 1 +date: '2022-07-25' +author: Bhavin Patel +type: Hunting +datamodel: [] +description: This analytic looks for `PutBucketLifecycle` events in Cloudtrail logs where a user has created a new lifecycle rule for an S3 bucket with a short expiration period. Attackers may use this API call to impair the Cloudtrail logging by removing logs from the S3 bucket by changing the object expiration day to 1 day, in which case the cloudtrail logs will be deleted. +search: '`cloudtrail` eventName=PutBucketLifecycle user_type=IAMUser errorCode=success +| spath path=requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days output=expiration_days +| spath path=requestParameters{}.bucketName output=bucket_name +| stats + count min(_time) as firstTime max(_time) as lastTime by src region eventName userAgent user_arn aws_account_id expiration_days bucket_name user_type| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | where expiration_days < 3 | `aws_defense_evasion_putbucketlifecycle_filter`' +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in + your AWS Environment. We recommend our users to set the expiration days value according to your company's log retention policies. +known_false_positives: While this search has no known false positives, it is possible + that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names. +references: +- https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/ +tags: + analytic_story: + - AWS Defense Evasion + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 40 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events.json + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: User $user_arn$ has created a new rule to on an S3 bucket $bucket_name$ with short expiration days + mitre_attack_id: + - T1562.008 + - T1562 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - requestParameters.name + - userAgent + - aws_account_id + - src + - region + - requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days + - requestParameters{}.bucketName + risk_score: 20 + security_domain: threat \ No newline at end of file diff --git a/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml b/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml index e0d00e0eb6..fb034e82af 100644 --- a/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml +++ b/tests/cloud/aws_defense_evasion_delete_cloudtrail.test.yml @@ -6,7 +6,6 @@ tests: earliest_time: -24h latest_time: now attack_data: - attack_data: - file_name: aws_cloudtrail_events.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json sourcetype: aws:cloudtrail diff --git a/tests/cloud/aws_defense_evasion_putbucketlifecycle.test.yml b/tests/cloud/aws_defense_evasion_putbucketlifecycle.test.yml new file mode 100644 index 0000000000..f4d00bc9cc --- /dev/null +++ b/tests/cloud/aws_defense_evasion_putbucketlifecycle.test.yml @@ -0,0 +1,13 @@ +name: AWS Defense Evasion PutBucketLifecycle Unit Test +tests: +- name: AWS Defense Evasion PutBucketLifecycle + file: cloud/aws_defense_evasion_putbucketlifecycle.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 2dd87d6d330fd77fea8a552754533047ac996a68 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 26 Jul 2022 12:02:35 +0200 Subject: [PATCH 13/17] dcrat-analytics --- .../endpoint/any_powershell_downloadfile.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + ...s_powershell_process___encoded_command.yml | 1 + ...hell_process___execution_policy_bypass.yml | 1 + .../office_document_executing_macro_code.yml | 1 + .../office_product_spawn_cmd_process.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 1 + detections/endpoint/winword_spawning_cmd.yml | 1 + .../endpoint/winword_spawning_powershell.yml | 1 + stories/darkcrystal_rat.yml | 24 +++++++++++++++++++ 10 files changed, 33 insertions(+) create mode 100644 stories/darkcrystal_rat.yml diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 43730b9334..17fb173073 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -35,6 +35,7 @@ tags: - Malicious PowerShell - Ingress Tool Transfer - Log4Shell CVE-2021-44228 + - DarkCrystal RAT confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 2d7567db60..d7909ae2a3 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -43,6 +43,7 @@ tags: - Hermetic Wiper - Industroyer2 - Azorult + - DarkCrystal RAT automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4352f949f6..40babd109a 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -44,6 +44,7 @@ tags: - Malicious PowerShell - NOBELIUM Group - WhisperGate + - DarkCrystal RAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index a4c8ef2564..0d1737fdd4 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -29,6 +29,7 @@ tags: analytic_story: - DHS Report TA18-074A - HAFNIUM Group + - DarkCrystal RAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index bd6d5aecb7..d072573d39 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -30,6 +30,7 @@ tags: - Spearphishing Attachments - Trickbot - IcedID + - DarkCrystal RAT confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 61dce8802b..ee2c24c7c4 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Trickbot + - DarkCrystal RAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 40cedea8de..d5cc4c4d33 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -39,6 +39,7 @@ tags: - WhisperGate - Hermetic Wiper - Industroyer2 + - DarkCrystal RAT automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 330359665c..abfd380d59 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - DarkCrystal RAT confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 26500a08b9..3a9ef16100 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - DarkCrystal RAT confidence: 100 context: - Source:Endpoint diff --git a/stories/darkcrystal_rat.yml b/stories/darkcrystal_rat.yml new file mode 100644 index 0000000000..2b2f8728b0 --- /dev/null +++ b/stories/darkcrystal_rat.yml @@ -0,0 +1,24 @@ +name: DarkCrystal RAT +id: 639e6006-0885-4847-9394-ddc2902629bf +version: 1 +date: '2022-07-26' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. + The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest + commercial RATs. + DcRat is modular and bespoke plugin framework make it a very flexible option, helpful for a range of nefearious uses. +narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat +tags: + analytic_story: DarkCrystal RAT + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 8672c8d8243826a395d0c4d115cf0179a3a35366 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 26 Jul 2022 16:54:42 -0700 Subject: [PATCH 14/17] security sercvices deleteion activities --- ...fense_evasion_impair_security_services.yml | 65 +++++++++++++++++++ ..._evasion_impair_security_services.test.yml | 13 ++++ 2 files changed, 78 insertions(+) create mode 100644 detections/cloud/aws_defense_evasion_impair_security_services.yml create mode 100644 tests/cloud/aws_defense_evasion_impair_security_services.test.yml diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml new file mode 100644 index 0000000000..c1bef99d43 --- /dev/null +++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml @@ -0,0 +1,65 @@ +name: AWS Defense Evasion Impair Security Services +id: b28c4957-96a6-47e0-a965-6c767aac1458 +version: 1 +date: '2022-07-26' +author: Bhavin Patel, Gowthamaraj Rajendran, Splunk +type: Hunting +datamodel: [] +description: This analytic looks for several delete specific API calls made to AWS Security Services like CloudWatch, Guardduy, Web Application Firewalls. These API calls are often leveraged by adversaries to weaken your exiting security defenses to deleting logging configurations in the cloudwatch alarm, delete a set of detectors from your Guardduty environment or simply delete a bunch of cloudwatch alarams to remain stealthy and avoid detection. These API calls +search: '`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") | stats + count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(eventSource) as eventSource values(requestParameters.*) as * by src region user_arn aws_account_id user_type user_agent errorCode| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`' +how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in + your AWS Environment. +known_false_positives: While this search has no known false positives, it is possible + that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names. +references: +- https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html +- https://docs.aws.amazon.com/cli/latest/reference/waf/index.html +tags: + analytic_story: + - AWS Defense Evasion + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events.json + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: User $user_arn$ has made + mitre_attack_id: + - T1562.008 + - T1562 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - eventSource + - user_agent + - user_type + - aws_account_id + - src + - region + - errorCode + risk_score: 42 + security_domain: threat \ No newline at end of file diff --git a/tests/cloud/aws_defense_evasion_impair_security_services.test.yml b/tests/cloud/aws_defense_evasion_impair_security_services.test.yml new file mode 100644 index 0000000000..a4d0bbe30b --- /dev/null +++ b/tests/cloud/aws_defense_evasion_impair_security_services.test.yml @@ -0,0 +1,13 @@ +name: AWS Defense Evasion Impair Security Services Unit Test +tests: +- name: AWS Defense Evasion Impair Security Services + file: cloud/aws_defense_evasion_impair_security_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From a78c180836463863224e53b3700807179254c364 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 26 Jul 2022 17:21:56 -0700 Subject: [PATCH 15/17] file update --- .../aws_defense_evasion_impair_security_services.yml | 6 +++--- ...s_defense_evasion_impair_security_services.test.yml | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml index c1bef99d43..23480d2e09 100644 --- a/detections/cloud/aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml @@ -7,8 +7,7 @@ type: Hunting datamodel: [] description: This analytic looks for several delete specific API calls made to AWS Security Services like CloudWatch, Guardduy, Web Application Firewalls. These API calls are often leveraged by adversaries to weaken your exiting security defenses to deleting logging configurations in the cloudwatch alarm, delete a set of detectors from your Guardduty environment or simply delete a bunch of cloudwatch alarams to remain stealthy and avoid detection. These API calls search: '`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") | stats - count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(eventSource) as eventSource values(requestParameters.*) as * by src region user_arn aws_account_id user_type user_agent errorCode| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`' + count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(eventSource) as eventSource values(requestParameters.*) as * by src region user_arn aws_account_id user_type user_agent errorCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`' how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible @@ -16,6 +15,7 @@ known_false_positives: While this search has no known false positives, it is pos references: - https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html - https://docs.aws.amazon.com/cli/latest/reference/waf/index.html +- https://www.elastic.co/guide/en/security/current/prebuilt-rules.html tags: analytic_story: - AWS Defense Evasion @@ -32,7 +32,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: User $user_arn$ has made + message: User $user_arn$ has made potentially risky api calls $eventName$ that could impair AWS security services for account id $aws_account_id$ mitre_attack_id: - T1562.008 - T1562 diff --git a/tests/cloud/aws_defense_evasion_impair_security_services.test.yml b/tests/cloud/aws_defense_evasion_impair_security_services.test.yml index a4d0bbe30b..8bdaeed995 100644 --- a/tests/cloud/aws_defense_evasion_impair_security_services.test.yml +++ b/tests/cloud/aws_defense_evasion_impair_security_services.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE - update_timestamp: true + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From 84352e2511a3ec034f0a54adcc9a4725c31f0279 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Thu, 28 Jul 2022 09:12:54 -0400 Subject: [PATCH 16/17] Delete CNAME --- docs/CNAME | 1 - 1 file changed, 1 deletion(-) delete mode 100644 docs/CNAME diff --git a/docs/CNAME b/docs/CNAME deleted file mode 100644 index 900af49d09..0000000000 --- a/docs/CNAME +++ /dev/null @@ -1 +0,0 @@ -research.splunk.com \ No newline at end of file From 508424da99403e0e9b1035fb023fae9edeb11e6b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 28 Jul 2022 12:07:05 -0600 Subject: [PATCH 17/17] Updates --- .../aws_defense_evasion_delete_cloudtrail.yml | 8 ++++---- ...defense_evasion_delete_cloudwatch_log_group.yml | 8 ++++---- ...ws_defense_evasion_impair_security_services.yml | 4 ++-- .../aws_defense_evasion_putbucketlifecycle.yml | 4 ++-- ...aws_defense_evasion_stop_logging_cloudtrail.yml | 2 +- .../aws_defense_evasion_update_cloudtrail.yml | 8 ++++---- stories/aws_defense_evasion.yml | 14 +++++++------- 7 files changed, 24 insertions(+), 24 deletions(-) diff --git a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml index 4a4b47d560..28ed07f87f 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml @@ -5,14 +5,14 @@ date: '2022-07-13' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: This search looks for `DeleteTrail` events in Cloudtrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they can operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they can delete the the entire cloudtrail that is logging activities in your environment. +description: This analytic identifies AWS `DeleteTrail` events within CloudTrail logs. Adversaries often try to impair their target's defenses by stopping their malicious activity from being logged, so that they may operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they may delete the the entire cloudtrail that is logging activities in the environment. search: '`cloudtrail` eventName = DeleteTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as deleted_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudtrail_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible - that an AWS admin has stopped cloudtrail logging. Please investigate this activity. + that an AWS admin has stopped cloudTrail logging. Please investigate this activity. references: - https://attack.mitre.org/techniques/T1562/008/ tags: @@ -31,7 +31,7 @@ tags: impact: 100 kill_chain_phases: - Actions on Objectives - message: User $user_arn$ has delete a cloudtrail logging for account id $aws_account_id$ from IP $src$ + message: User $user_arn$ has delete a CloudTrail logging for account id $aws_account_id$ from IP $src$ mitre_attack_id: - T1562.008 - T1562 diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml index 8bbc93d5fd..ee5115436f 100644 --- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -5,13 +5,13 @@ date: '2022-07-17' author: Gowthamaraj Rajendran, Splunk type: TTP datamodel: [] -description: This search looks for `DeleteLogGroup` events in Cloudtrail logs. Attackers can evade the logging capability by deleting the log group in cloudwatch. - This will stop sending the lops and metrics to CloudWatch. When the adversary has the right type of permissions in the compromised AWS environment, - they can delete the CloudWatch log group that is logging activities in your environment. +description: This analytic identifies AWS `DeleteLogGroup` events in CloudTrail logs. Attackers may evade the logging capability by deleting the log group in CloudWatch. + This will stop sending the logs and metrics to CloudWatch. When the adversary has the right type of permissions within the compromised AWS environment, + they may delete the CloudWatch log group that is logging activities in the environment. search: '`cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.logGroupName) as log_group_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_delete_cloudwatch_log_group_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity. diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml index 23480d2e09..eec8339fb2 100644 --- a/detections/cloud/aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml @@ -5,10 +5,10 @@ date: '2022-07-26' author: Bhavin Patel, Gowthamaraj Rajendran, Splunk type: Hunting datamodel: [] -description: This analytic looks for several delete specific API calls made to AWS Security Services like CloudWatch, Guardduy, Web Application Firewalls. These API calls are often leveraged by adversaries to weaken your exiting security defenses to deleting logging configurations in the cloudwatch alarm, delete a set of detectors from your Guardduty environment or simply delete a bunch of cloudwatch alarams to remain stealthy and avoid detection. These API calls +description: This analytic looks for several delete specific API calls made to AWS Security Services like CloudWatch, GuardDuty and Web Application Firewalls. These API calls are often leveraged by adversaries to weaken existing security defenses by deleting logging configurations in the CloudWatch alarm, delete a set of detectors from your Guardduty environment or simply delete a bunch of CloudWatch alarms to remain stealthy and avoid detection. search: '`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") | stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(eventSource) as eventSource values(requestParameters.*) as * by src region user_arn aws_account_id user_type user_agent errorCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_defense_evasion_impair_security_services_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names. diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml index 0f6c2ddb2b..b0b7ef47a0 100644 --- a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml +++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml @@ -5,14 +5,14 @@ date: '2022-07-25' author: Bhavin Patel type: Hunting datamodel: [] -description: This analytic looks for `PutBucketLifecycle` events in Cloudtrail logs where a user has created a new lifecycle rule for an S3 bucket with a short expiration period. Attackers may use this API call to impair the Cloudtrail logging by removing logs from the S3 bucket by changing the object expiration day to 1 day, in which case the cloudtrail logs will be deleted. +description: This analytic identifies `PutBucketLifecycle` events in CloudTrail logs where a user has created a new lifecycle rule for an S3 bucket with a short expiration period. Attackers may use this API call to impair the CloudTrail logging by removing logs from the S3 bucket by changing the object expiration day to 1 day, in which case the CloudTrail logs will be deleted. search: '`cloudtrail` eventName=PutBucketLifecycle user_type=IAMUser errorCode=success | spath path=requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days output=expiration_days | spath path=requestParameters{}.bucketName output=bucket_name | stats count min(_time) as firstTime max(_time) as lastTime by src region eventName userAgent user_arn aws_account_id expiration_days bucket_name user_type| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where expiration_days < 3 | `aws_defense_evasion_putbucketlifecycle_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. We recommend our users to set the expiration days value according to your company's log retention policies. known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names. diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml index b5d0b88c7a..c907b3bad0 100644 --- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml @@ -5,7 +5,7 @@ date: '2022-07-12' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: This search looks for `StopLogging` events in Cloudtrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they can operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they can easily stop logging. +description: This analytic identifies `StopLogging` events in CloudTrail logs. Adversaries often try to impair their target's defenses by stopping their macliious activity from being logged, so that they may operate with stealth and avoid detection. When the adversary has the right type of permissions in the compromised AWS environment, they may easily stop logging. search: '`cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as stopped_cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_defense_evasion_stop_logging_cloudtrail_filter`' diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml index 987e958ae3..c87ce7aa99 100644 --- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml @@ -5,14 +5,14 @@ date: '2022-07-17' author: Gowthamaraj Rajendran, Splunk type: TTP datamodel: [] -description: This search looks for `UpdateTrail` events in Cloudtrail logs. Attackers can evade the logging capability by updating the settings and impairing - them with wrong parameters. For example, Attackers can change the multi-regional log into a single region logs, which evades the logging for other regions. - When the adversary has the right type of permissions in the compromised AWS environment, they can update the cloudtrail settings that is logging activities +description: This analytic identifies `UpdateTrail` events in CloudTrail logs. Attackers may evade the logging capability by updating the settings and impairing + them with wrong parameters. For example, Attackers may change the multi-regional log into a single region logs, which evades the logging for other regions. + When the adversary has the right type of permissions in the compromised AWS environment, they may update the CloudTrail settings that is logging activities in your environment. search: '`cloudtrail` eventName = UpdateTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.name) as cloudtrail_name by src region eventName userAgent user_arn aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `aws_defense_evasion_update_cloudtrail_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity. diff --git a/stories/aws_defense_evasion.yml b/stories/aws_defense_evasion.yml index 8b2f7ad5c7..4e03a4d78f 100644 --- a/stories/aws_defense_evasion.yml +++ b/stories/aws_defense_evasion.yml @@ -3,15 +3,15 @@ id: 4e00b690-293f-434d-a9d8-bcfb2ea5fff9 version: 1 date: '2022-07-15' author: Gowthamaraj Rajendran, Splunk -description: Looks for activities and techniques associated with the Evasion of - Defenses on AWS Environment, such as Disabling cloud trail, Deleting cloud trail and many others. -narrative: Attackers employ a variety of tactics in order to avoid detection and operate +description: Identify activity and techniques associated with the Evasion of + Defenses within AWS, such as Disabling CloudTrail, Deleting CloudTrail and many others. +narrative: Adversaries employ a variety of techniques in order to avoid detection and operate without barriers. This often involves modifying the configuration of security monitoring tools to get around them or explicitly disabling them to prevent them from running. This - Analytic Story includes searches that look for activity consistent with attackers - attempting to disable various security mechanisms. Such activity may involve deleting the cloudtrail logs - , as this is where all the AWS logs get stored or explicitly changing the retention policy of s3 buckets. - Other times, attackers attempt deletion of a specified AWS CloudWatch log group. + Analytic Story includes analytics that identify activity consistent with adversaries + attempting to disable various security mechanisms on AWS. Such activity may involve deleting the CloudTrail logs , + as this is where all the AWS logs get stored or explicitly changing the retention policy of S3 buckets. + Other times, adversaries attempt deletion of a specified AWS CloudWatch log group. references: - https://attack.mitre.org/tactics/TA0005/ tags: