From 73465c619398532a1a971fa8c5e36f11a08b52e3 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 22 Mar 2023 15:50:01 -0500
Subject: [PATCH 01/20] updating  spl

---
 ...yml => aws_ec2_snapshot_shared_externally.yml} | 15 +++++++--------
 ...> aws_ec2_snapshot_shared_externally.test.yml} |  6 +++---
 2 files changed, 10 insertions(+), 11 deletions(-)
 rename detections/cloud/{detect_shared_ec2_snapshot.yml => aws_ec2_snapshot_shared_externally.yml} (84%)
 rename tests/cloud/{detect_shared_ec2_snapshot.test.yml => aws_ec2_snapshot_shared_externally.test.yml} (73%)

diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
similarity index 84%
rename from detections/cloud/detect_shared_ec2_snapshot.yml
rename to detections/cloud/aws_ec2_snapshot_shared_externally.yml
index 7520267481..0122ecb5b0 100644
--- a/detections/cloud/detect_shared_ec2_snapshot.yml
+++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
@@ -1,7 +1,7 @@
-name: Detect shared ec2 snapshot
+name: AWS EC2 Snapshot Shared Externally
 id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
-version: 2
-date: '2021-07-20'
+version: 3
+date: '2023-03-20'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel: []
@@ -9,9 +9,7 @@ description: The following analytic utilizes AWS CloudTrail events to identify w
   an EC2 snapshot permissions are modified to be shared with a different AWS account.
   This method is used by adversaries to exfiltrate the EC2 snapshot.
 search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
-  as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
-  Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
-  aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` '
+  as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent userIdentity.principalId | where match = "No Match" | `aws_ec2_snapshot_shared_externally_filter` '
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS admin has legitimately shared a
@@ -34,7 +32,7 @@ tags:
   - Stage:Exfiltration
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
-  impact: 60
+  impact: 100
   kill_chain_phases:
   - Actions on Objectives
   message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$
@@ -67,5 +65,6 @@ tags:
   - aws_account_id
   - vendor_region
   - user_agent
-  risk_score: 48
+  - userIdentity.principalId
+  risk_score: 80
   security_domain: threat
diff --git a/tests/cloud/detect_shared_ec2_snapshot.test.yml b/tests/cloud/aws_ec2_snapshot_shared_externally.test.yml
similarity index 73%
rename from tests/cloud/detect_shared_ec2_snapshot.test.yml
rename to tests/cloud/aws_ec2_snapshot_shared_externally.test.yml
index a8c847b576..6fdd003e0e 100644
--- a/tests/cloud/detect_shared_ec2_snapshot.test.yml
+++ b/tests/cloud/aws_ec2_snapshot_shared_externally.test.yml
@@ -1,7 +1,7 @@
-name: Detect shared ec2 snapshot Unit Test
+name: AWS EC2 Snapshot Shared Externally Unit Test
 tests:
-- name: Detect shared ec2 snapshot
-  file: cloud/detect_shared_ec2_snapshot.yml
+- name: AWS EC2 Snapshot Shared Externally
+  file: cloud/aws_ec2_snapshot_shared_externally.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -7d
   latest_time: now

From 1bff7be3d81473c50ae740d57339f46152c86dc8 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 22 Mar 2023 17:11:35 -0500
Subject: [PATCH 02/20] adding new detection

---
 ...aws_ec2_snapshot_possible_exfiltration.yml | 75 +++++++++++++++++++
 ...c2_snapshot_possible_exfiltration.test.yml | 13 ++++
 ...ws_ec2_snapshot_shared_externally.test.yml |  4 +-
 3 files changed, 90 insertions(+), 2 deletions(-)
 create mode 100644 detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml
 create mode 100644 tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml

diff --git a/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml b/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml
new file mode 100644
index 0000000000..e2163288ff
--- /dev/null
+++ b/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml
@@ -0,0 +1,75 @@
+name: AWS EC2 Snapshot Possible Exfiltration
+id: ac90b339-13fc-4f29-a18c-4abbba1f2171
+version: 1
+date: '2023-03-22'
+author: BHavin P
+type: Hunting
+datamodel:
+- Endpoint
+description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a possible exfiltration via EC2 Snapshots. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
+search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") 
+|  bin _time span=5m 
+|  stats count dc(eventName) as distinct_api_calls values(eventName)  values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id 
+| where distinct_api_calls >= 2 | `aws_ec2_snapshot_possible_exfiltration_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS admin has legitimately shared a
+  snapshot with others for  a specific purpose.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+tags:
+  analytic_story:
+  - Suspicious Cloud Instance Activities
+  - Data Exfiltration
+  asset_type: EC2 Snapshot
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
+  mitre_attack_id:
+  - T1537
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - requestParameters.attributeType
+  - aws_account_id
+  - vendor_region
+  - user_agent
+  - userIdentity.principalId
+  - requestParameters.createVolumePermission.add.items{}.userId
+  risk_score: 64
+  security_domain: threat
\ No newline at end of file
diff --git a/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml b/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml
new file mode 100644
index 0000000000..a6295f33ec
--- /dev/null
+++ b/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml
@@ -0,0 +1,13 @@
+name: AWS EC2 Snapshot Possible Exfiltration Unit Test
+tests:
+- name: AWS EC2 Snapshot Possible Exfiltration
+  file: cloud/aws_ec2_snapshot_possible_exfiltration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -7d
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
diff --git a/tests/cloud/aws_ec2_snapshot_shared_externally.test.yml b/tests/cloud/aws_ec2_snapshot_shared_externally.test.yml
index 6fdd003e0e..abf09c1457 100644
--- a/tests/cloud/aws_ec2_snapshot_shared_externally.test.yml
+++ b/tests/cloud/aws_ec2_snapshot_shared_externally.test.yml
@@ -1,6 +1,6 @@
 name: AWS EC2 Snapshot Shared Externally Unit Test
 tests:
-- name: AWS EC2 Snapshot Shared Externally
+- name: AWS EC2 Snapshot Shared aws_ec2_snapshot_shared_externally
   file: cloud/aws_ec2_snapshot_shared_externally.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -7d
@@ -10,4 +10,4 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true
+    update_timestamp: true
\ No newline at end of file

From 47ad12bfacbb79ed5a2a0e2cc3fe667596bf0a58 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 23 Mar 2023 13:33:39 -0500
Subject: [PATCH 03/20] updated names

---
 ...n.yml => aws_exfiltration_via_ec2_snapshot.yml} | 14 +++++++-------
 ... => aws_exfiltration_via_ec2_snapshot.test.yml} |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)
 rename detections/cloud/{aws_ec2_snapshot_possible_exfiltration.yml => aws_exfiltration_via_ec2_snapshot.yml} (68%)
 rename tests/cloud/{aws_ec2_snapshot_possible_exfiltration.test.yml => aws_exfiltration_via_ec2_snapshot.test.yml} (71%)

diff --git a/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
similarity index 68%
rename from detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml
rename to detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
index e2163288ff..19cbc0684f 100644
--- a/detections/cloud/aws_ec2_snapshot_possible_exfiltration.yml
+++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
@@ -1,4 +1,4 @@
-name: AWS EC2 Snapshot Possible Exfiltration
+name: AWS Exfiltration via EC2 Snapshot
 id: ac90b339-13fc-4f29-a18c-4abbba1f2171
 version: 1
 date: '2023-03-22'
@@ -6,17 +6,17 @@ author: BHavin P
 type: Hunting
 datamodel:
 - Endpoint
-description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a possible exfiltration via EC2 Snapshots. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
-search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") 
+description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
+search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") src_ip NOT IN ("guardduty.amazonaws.com")
 |  bin _time span=5m 
 |  stats count dc(eventName) as distinct_api_calls values(eventName)  values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id 
-| where distinct_api_calls >= 2 | `aws_ec2_snapshot_possible_exfiltration_filter`'
+| where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: It is possible that an AWS admin has legitimately shared a
-  snapshot with others for  a specific purpose.
+  search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment. 
+known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization. 
 references:
 - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities
diff --git a/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml b/tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml
similarity index 71%
rename from tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml
rename to tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml
index a6295f33ec..9e86673bd6 100644
--- a/tests/cloud/aws_ec2_snapshot_possible_exfiltration.test.yml
+++ b/tests/cloud/aws_exfiltration_via_ec2_snapshot.test.yml
@@ -1,7 +1,7 @@
-name: AWS EC2 Snapshot Possible Exfiltration Unit Test
+name: AWS Exfiltration via EC2 Snapshot Unit Test
 tests:
-- name: AWS EC2 Snapshot Possible Exfiltration
-  file: cloud/aws_ec2_snapshot_possible_exfiltration.yml
+- name: AWS Exfiltration via EC2 Snapshot
+  file: cloud/aws_exfiltration_via_ec2_snapshot.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -7d
   latest_time: now

From 25efe7ee56a5cf8277fe1a4ae06362b3c57e1e85 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 23 Mar 2023 16:50:51 -0500
Subject: [PATCH 04/20] updates

---
 detections/cloud/aws_ec2_snapshot_shared_externally.yml | 2 ++
 detections/cloud/aws_exfiltration_via_ec2_snapshot.yml  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/detections/cloud/aws_ec2_snapshot_shared_externally.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
index 0122ecb5b0..bcbccedaf2 100644
--- a/detections/cloud/aws_ec2_snapshot_shared_externally.yml
+++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
@@ -16,6 +16,8 @@ known_false_positives: It is possible that an AWS admin has legitimately shared
   snapshot with others for  a specific purpose.
 references:
 - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
+- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities
diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
index 19cbc0684f..1e843d4f81 100644
--- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
+++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
@@ -7,7 +7,7 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
-search: '`cloudtrail` eventName IN ("DescribeSnapshotAttribute", "CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute") src_ip NOT IN ("guardduty.amazonaws.com")
+search: '`cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip NOT IN ("guardduty.amazonaws.com")
 |  bin _time span=5m 
 |  stats count dc(eventName) as distinct_api_calls values(eventName)  values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id 
 | where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`'

From b581bfda8a3471666bfee253c342b35ecaab4954 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 31 Mar 2023 15:06:02 -0500
Subject: [PATCH 05/20] new detection for aws ami share

---
 ...ttribute_modification_for_exfiltration.yml | 74 +++++++++++++++++++
 ...ute_modification_for_exfiltration.test.yml | 13 ++++
 2 files changed, 87 insertions(+)
 create mode 100644 detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
 create mode 100644 tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml

diff --git a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
new file mode 100644
index 0000000000..3c1bc1ce89
--- /dev/null
+++ b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
@@ -0,0 +1,74 @@
+name: AWS AMI Atttribute Modification for Exfiltration
+id: f2132d74-cf81-4c5e-8799-ab069e67dc9f
+version: 1
+date: '2023-03-31'
+author: Bhavin Patel
+type: TTP
+datamodel:
+- Endpoint
+description: This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
+search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) 
+|  rename requestParameters.launchPermission.add.items{}.group as group_added 
+|  rename requestParameters.launchPermission.add.items{}.userId as accounts_added
+ | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")  | stats
+  count min(_time) as firstTime max(_time) as lastTime  values(group_added) values(accounts_added) as accounts_added values(ami_status) by  src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId 
+|  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_atttribute_modification_for_exfiltration_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS admin has legitimately shared a
+  snapshot with others for  a specific purpose.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
+- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
+tags:
+  analytic_story:
+  - Suspicious Cloud Instance Activities
+  - Data Exfiltration
+  asset_type: EC2 Snapshot
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$
+  mitre_attack_id:
+  - T1537
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - requestParameters.attributeType
+  - aws_account_id
+  - vendor_region
+  - user_agent
+  - userIdentity.principalId
+  risk_score: 80
+  security_domain: threat
\ No newline at end of file
diff --git a/tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml b/tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml
new file mode 100644
index 0000000000..ec645dfd2a
--- /dev/null
+++ b/tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml
@@ -0,0 +1,13 @@
+name: AWS AMI Atttribute Modification for Exfiltration Unit Test
+tests:
+- name: AWS AMI Atttribute Modification for Exfiltration
+  file: cloud/aws_ami_atttribute_modification_for_exfiltration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true

From 2786c1335b7a5ca73f02788a65ccd9b66b994b82 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 3 Apr 2023 14:01:19 -0500
Subject: [PATCH 06/20] spl update

---
 .../aws_ami_atttribute_modification_for_exfiltration.yml      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
index 3c1bc1ce89..c252c4487c 100644
--- a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
+++ b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
@@ -19,7 +19,7 @@ known_false_positives: It is possible that an AWS admin has legitimately shared
   snapshot with others for  a specific purpose.
 references:
 - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
-- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ami/
 - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
 tags:
   analytic_story:
@@ -40,7 +40,7 @@ tags:
   impact: 100
   kill_chain_phases:
   - Actions on Objectives
-  message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$
+  message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$ or AMI made is made Public.
   mitre_attack_id:
   - T1537
   nist:

From c453ab592db48f544c3ff8667370ff3a4f9bc02d Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 10 Apr 2023 16:10:09 -0700
Subject: [PATCH 07/20] new_datasync_detection

---
 .../aws_exfiltration_via_datasync_task.yml    | 60 +++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 detections/cloud/aws_exfiltration_via_datasync_task.yml

diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml
new file mode 100644
index 0000000000..3c168fa773
--- /dev/null
+++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml
@@ -0,0 +1,60 @@
+name: AWS Exfiltration via DataSync Task
+id: 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
+version: 1
+date: '2023-04-10'
+author: Bhavin Patel, Splunk
+type: Hunting
+datamodel: []
+description: This search looks for potential misuse of an AWS service known as DataSync. This AWS service is used to transfer data between different AWS cloud storage services, such as Amazon S3, Amazon EFS, and Amazon FSx for Windows File Server. Attackers can create a task in AWS to periodically copy data from a private AWS location to a public location resulting in the compromise of the data.  
+search: '`cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com" | rename  requestParameters.*  as *  | stats count min(_time) as firstTime max(_time) as lastTime by src_ip aws_account_id awsRegion eventName destinationLocationArn sourceLocationArn userAgent user_arn userIdentity.principalId  errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+tags:
+  analytic_story:
+  - Data Exfiltration
+  asset_type: EC2 Snapshot
+  confidence: 80
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DataSync task created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
+  mitre_attack_id:
+  - T1119
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - aws_account_id
+  - destinationLocationArn
+  - sourceLocationArn
+  - userAgent
+  - userIdentity.principalId
+  risk_score: 64
+  security_domain: threat
\ No newline at end of file

From 95da1c3b3f68219fee09f8250431d627f271a3f3 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 10 Apr 2023 19:16:09 -0700
Subject: [PATCH 08/20] new anomaly detection

---
 ...n_via_anomalous_getobject_api_activity.yml | 59 +++++++++++++++++++
 .../aws_exfiltration_via_datasync_task.yml    |  2 +-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml

diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
new file mode 100644
index 0000000000..afbae4b0ca
--- /dev/null
+++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
@@ -0,0 +1,59 @@
+name: AWS Exfiltration via Anomalous GetObject API Activity
+id: e4384bbf-5835-4831-8d85-694de6ad2cc6
+version: 1
+date: '2023-04-10'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making GetObject API calls to download objects from S3. 
+search: '`cloudtrail` eventName=GetObject | bin _time span=10m |  stats count values(requestParameters.bucketName) as bucketName by _time user_type user_arn userIdentity.principalId
+| anomalydetection "count" "user_type" "user_arn" action=annotate | `aws_exfiltration_via_anomalous_getobject_api_activity_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that a user downloaded these files to use them locally.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+tags:
+  analytic_story:
+  - Data Exfiltration
+  asset_type: AWS Account
+  confidence: 80
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail.json
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Anomalous S3 activities detected by user $user_arn$ 
+  mitre_attack_id:
+  - T1119
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - aws_account_id
+  - userAgent
+  - userIdentity.principalId
+  risk_score: 64
+  security_domain: threat
\ No newline at end of file
diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml
index 3c168fa773..9bb3b11c9b 100644
--- a/detections/cloud/aws_exfiltration_via_datasync_task.yml
+++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml
@@ -15,7 +15,7 @@ references:
 tags:
   analytic_story:
   - Data Exfiltration
-  asset_type: EC2 Snapshot
+  asset_type: AWS Account
   confidence: 80
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json

From 925da0d998133139fa45d648eaea59dd258916a6 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 14 Apr 2023 10:30:25 -0700
Subject: [PATCH 09/20] exfiltrate everything

---
 ...ttribute_modification_for_exfiltration.yml | 33 +++++++------------
 .../aws_ec2_snapshot_shared_externally.yml    |  2 +-
 ...n_via_anomalous_getobject_api_activity.yml |  1 +
 .../aws_exfiltration_via_datasync_task.yml    |  1 +
 .../aws_exfiltration_via_ec2_snapshot.yml     |  1 +
 5 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
index c252c4487c..29fd9d8bc9 100644
--- a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
+++ b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
@@ -1,11 +1,11 @@
 name: AWS AMI Atttribute Modification for Exfiltration
 id: f2132d74-cf81-4c5e-8799-ab069e67dc9f
-version: 1
+version: 2
 date: '2023-03-31'
-author: Bhavin Patel
+author: BHavin Patel, Splunk
+status: production
 type: TTP
-datamodel:
-- Endpoint
+data_source: []
 description: This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
 search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) 
 |  rename requestParameters.launchPermission.add.items{}.group as group_added 
@@ -26,27 +26,11 @@ tags:
   - Suspicious Cloud Instance Activities
   - Data Exfiltration
   asset_type: EC2 Snapshot
-  cis20:
-  - CIS 13
   confidence: 80
-  context:
-  - Source:Cloud Data
-  - Scope:External
-  - Outcome:Allowed
-  - Stage:Execution
-  - Stage:Exfiltration
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json
   impact: 100
-  kill_chain_phases:
-  - Actions on Objectives
   message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$ or AMI made is made Public.
   mitre_attack_id:
   - T1537
-  nist:
-  - PR.DS
-  - PR.AC
-  - DE.CM
   observable:
   - name: user_arn
     type: User
@@ -71,4 +55,11 @@ tags:
   - user_agent
   - userIdentity.principalId
   risk_score: 80
-  security_domain: threat
\ No newline at end of file
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
\ No newline at end of file
diff --git a/detections/cloud/aws_ec2_snapshot_shared_externally.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
index 51dde42da5..d04e474626 100644
--- a/detections/cloud/aws_ec2_snapshot_shared_externally.yml
+++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
@@ -53,7 +53,7 @@ tags:
   - vendor_region
   - user_agent
   - userIdentity.principalId
-  risk_score: 80
+  risk_score: 48
   security_domain: threat
 tests:
 - name: True Positive Test
diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
index 259e7e6170..d0d09ff98e 100644
--- a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
+++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
@@ -50,6 +50,7 @@ tags:
   - userIdentity.principalId
   risk_score: 64
   security_domain: threat
+tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail.json
diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml
index a1bb5acd3c..bc926e02f9 100644
--- a/detections/cloud/aws_exfiltration_via_datasync_task.yml
+++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml
@@ -51,6 +51,7 @@ tags:
   - userIdentity.principalId
   risk_score: 64
   security_domain: threat
+tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
index 41fc4cfdd4..817b8b586d 100644
--- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
+++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
@@ -57,6 +57,7 @@ tags:
   - requestParameters.createVolumePermission.add.items{}.userId
   risk_score: 64
   security_domain: threat
+tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json

From 41be995a532af933300f8f27e3238dd6a8037cd1 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 24 Apr 2023 18:14:34 -0700
Subject: [PATCH 10/20] AWS exfil via JOBCREATED

---
 .../aws_exfiltration_via_batch_service.yml    | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 detections/cloud/aws_exfiltration_via_batch_service.yml

diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml
new file mode 100644
index 0000000000..c8dfea7b77
--- /dev/null
+++ b/detections/cloud/aws_exfiltration_via_batch_service.yml
@@ -0,0 +1,45 @@
+name: AWS Exfiltration via Batch Service
+id: 04455dd3-ced7-480f-b8e6-5469b99e98e2
+version: 1
+date: '2023-04-24'
+author: ''
+status: production
+type: TTP
+data_source:
+- UPDATE_DATA_SOURCE
+description: UPDATE_DESCRIPTION
+search: '| UPDATE_SPL | `aws_exfiltration_via_batch_service_filter`'
+how_to_implement: UPDATE_HOW_TO_IMPLEMENT
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: UPDATE asset_type
+  atomic_guid:
+  - UPDATE atomic_guid
+  confidence: UPDATE value between 1-100
+  drilldown_search:
+  - Add drilldown search
+  impact: UPDATE value between 1-100
+  message: UPDATE message
+  mitre_attack_id:
+  - T1003.002
+  observable:
+  - name: UPDATE
+    type: UPDATE
+    role:
+    - UPDATE
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: UPDATE (impact * confidence)/100
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: UPDATE source
+    sourcetype: UPDATE sourcetype

From 09c7a3a20b2531114cef6b080de853074f0d5fb5 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 25 Apr 2023 13:19:59 -0700
Subject: [PATCH 11/20] new detection

---
 .../aws_exfiltration_via_batch_service.yml    | 60 +++++++++++--------
 1 file changed, 36 insertions(+), 24 deletions(-)

diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml
index c8dfea7b77..0131d71200 100644
--- a/detections/cloud/aws_exfiltration_via_batch_service.yml
+++ b/detections/cloud/aws_exfiltration_via_batch_service.yml
@@ -5,41 +5,53 @@ date: '2023-04-24'
 author: ''
 status: production
 type: TTP
-data_source:
-- UPDATE_DATA_SOURCE
-description: UPDATE_DESCRIPTION
-search: '| UPDATE_SPL | `aws_exfiltration_via_batch_service_filter`'
-how_to_implement: UPDATE_HOW_TO_IMPLEMENT
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+data_source: []
+description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. 
+search: '`cloudtrail` eventName = JobCreated |  stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. 
 references:
-- REFERENCE
+- https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
-  asset_type: UPDATE asset_type
-  atomic_guid:
-  - UPDATE atomic_guid
-  confidence: UPDATE value between 1-100
-  drilldown_search:
-  - Add drilldown search
-  impact: UPDATE value between 1-100
-  message: UPDATE message
+  - Data Exfiltration
+  asset_type: AWS Account
+  confidence: 80
+  impact: 80
+  message: AWS Batch Job is created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$
   mitre_attack_id:
-  - T1003.002
+  - T1119
   observable:
-  - name: UPDATE
-    type: UPDATE
+  - name: user_arn
+    type: User
     role:
-    - UPDATE
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  risk_score: UPDATE (impact * confidence)/100
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - aws_account_id
+  - userAgent
+  risk_score: 64
   security_domain: threat
 tests:
 - name: True Positive Test
   attack_data:
-  - data: UPDATE url to dataset
-    source: UPDATE source
-    sourcetype: UPDATE sourcetype
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
\ No newline at end of file

From 18d0ba580d2aef4a3b97186bea5735cb66b625c1 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 28 Apr 2023 15:00:22 -0700
Subject: [PATCH 12/20] bucket replication

---
 ...ws_exfiltration_via_bucket_replication.yml | 68 +++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 detections/cloud/aws_exfiltration_via_bucket_replication.yml

diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
new file mode 100644
index 0000000000..61f506928d
--- /dev/null
+++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
@@ -0,0 +1,68 @@
+name: AWS Exfiltration via Bucket Replication
+id: eeb432d6-2212-43b6-9e89-fcd753f7da4c
+version: 1
+date: '2023-04-28'
+author: Bhavin Patel, Splunk
+status: production
+type: TTP
+data_source: []
+description: There have been reports of malicious actors using S3 bucket replication as a means of data exfiltration. This search detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\
+
+S3 bucket replication can also be used for cross-account replication, where data is replicated from a source 
+bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
+
+search: '`cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com
+|  rename requestParameters.* as * 
+| stats count values(bucketName) as source_bucket values(ReplicationConfiguration.Rule.ID) as rule_id values(ReplicationConfiguration.Rule.Destination.Bucket) as destination_bucket by _time user_arn userName user_type src_ip aws_account_id userIdentity.principalId user_agent | `aws_exfiltration_via_ec2_snapshot_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies.
+references:
+- https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/
+tags:
+  analytic_story:
+  - Suspicious Cloud Instance Activities
+  - Data Exfiltration
+  asset_type: EC2 Snapshot
+  confidence: 80
+  impact: 80
+  message: AWS Bucket Replication rule $rule$ added on $source_bucket$ to $destination_bucket$ by user $user_arn$ from IP Address - $src_ip$
+  mitre_attack_id:
+  - T1537
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - eventSource
+  - requestParameters.*
+  - aws_account_id
+  - vendor_region
+  - user_agent
+  - userIdentity.principalId
+  risk_score: 64
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
\ No newline at end of file

From c0ee1f8f2aa9904f3eea448934e6d6353573d844 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 28 Apr 2023 15:16:46 -0700
Subject: [PATCH 13/20] updates and new searches

---
 ...ws_exfiltration_via_bucket_replication.yml |  3 +--
 .../aws_exfiltration_via_datasync_task.yml    |  1 +
 stories/suspicious_aws_s3_activities.yml      | 26 +++++++------------
 3 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
index 61f506928d..8ccdfb283d 100644
--- a/detections/cloud/aws_exfiltration_via_bucket_replication.yml
+++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
@@ -10,7 +10,6 @@ description: There have been reports of malicious actors using S3 bucket replica
 
 S3 bucket replication can also be used for cross-account replication, where data is replicated from a source 
 bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
-
 search: '`cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com
 |  rename requestParameters.* as * 
 | stats count values(bucketName) as source_bucket values(ReplicationConfiguration.Rule.ID) as rule_id values(ReplicationConfiguration.Rule.Destination.Bucket) as destination_bucket by _time user_arn userName user_type src_ip aws_account_id userIdentity.principalId user_agent | `aws_exfiltration_via_ec2_snapshot_filter`'
@@ -21,7 +20,7 @@ references:
 - https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/
 tags:
   analytic_story:
-  - Suspicious Cloud Instance Activities
+  - Suspicious AWS S3 Activities
   - Data Exfiltration
   asset_type: EC2 Snapshot
   confidence: 80
diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml
index bc926e02f9..99a57afc1c 100644
--- a/detections/cloud/aws_exfiltration_via_datasync_task.yml
+++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml
@@ -15,6 +15,7 @@ references:
 - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
 tags:
   analytic_story:
+  - Suspicious AWS S3 Activities
   - Data Exfiltration
   asset_type: AWS Account
   confidence: 80
diff --git a/stories/suspicious_aws_s3_activities.yml b/stories/suspicious_aws_s3_activities.yml
index e2f1ac3589..fa07973722 100644
--- a/stories/suspicious_aws_s3_activities.yml
+++ b/stories/suspicious_aws_s3_activities.yml
@@ -1,27 +1,21 @@
 name: Suspicious AWS S3 Activities
 id: 66732346-8fb0-407b-9633-da16756567d6
-version: 2
-date: '2018-07-24'
+version: 3
+date: '2023-04-24'
 author: Bhavin Patel, Splunk
-description: Use the searches in this Analytic Story to monitor your AWS S3 buckets
+description: Use the searches in this Analytic Story using Cloudtrail logs to to monitor your AWS S3 buckets
   for evidence of anomalous activity and suspicious behaviors, such as detecting open
-  S3 buckets and buckets being accessed from a new IP. The contextual and investigative
-  searches will give you more information, when required.
-narrative: 'As cloud computing has exploded, so has the number of creative attacks
-  on virtual environments. And as the number-two cloud-service provider, Amazon Web
-  Services (AWS) has certainly had its share.\
+  S3 buckets and buckets being accessed from a new IP, permission and policy updates to the bucket, potential misuse of other services leading to data being leaked.  
 
-  Amazon''s "shared responsibility" model dictates that the company has responsibility
-  for the environment outside of the VM and the customer is responsible for the security
-  inside of the S3 container. As such, it''s important to stay vigilant for activities
-  that may belie suspicious behavior inside of your environment.\
+narrative: 'One of the most common ways that attackers attempt to steal data from S3 is by gaining unauthorized access to S3 buckets and copying or exfiltrating data to external locations.\
 
-  Among things to look out for are S3 access from unfamiliar locations and by unfamiliar
-  users. Some of the searches in this Analytic Story help you detect suspicious behavior
-  and others help you investigate more deeply, when the situation warrants.   '
+  However, suspicious S3 activities can refer to any unusual behavior detected within an Amazon Web Services (AWS) Simple Storage Service (S3) bucket, including unauthorized access, unusual data transfer patterns, and access attempts from unknown IP addresses. \
+
+ It is important for organizations to regularly monitor S3 activities for suspicious behavior and implement security best practices, such as using access controls, encryption, and strong authentication mechanisms, to protect sensitive data stored within S3 buckets. By staying vigilant and taking proactive measures, organizations can help prevent potential security breaches and minimize the impact of attacks if they do occur.'
 references:
-- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
+- https://github.com/nagwww/s3-leaks
 - https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/
+- 
 tags:
   analytic_story: Suspicious AWS S3 Activities
   category:

From c108c62648e6ad6ca0c317e9299f01dd85f587a4 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 1 May 2023 18:15:01 -0700
Subject: [PATCH 14/20] new s3 verrsioning

---
 .../cloud/aws_disable_bucket_versioning.yml   | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 detections/cloud/aws_disable_bucket_versioning.yml

diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml
new file mode 100644
index 0000000000..f1537d3c49
--- /dev/null
+++ b/detections/cloud/aws_disable_bucket_versioning.yml
@@ -0,0 +1,62 @@
+name: AWS Disable Bucket Versioning
+id: 657902a9-987d-4879-a1b2-e7a65512824b
+version: 1
+date: '2023-05-01'
+author: Bhavin Patel, Splunk
+status: production
+type: Anomaly
+data_source: []
+description: This searach looks for Cloudtrail events where bucket versioning is suspended by a user. Versioning allows the AWS Administrators to maintain different version of the S3 bucket which can be used to recover deleted data. Adversaries are seen to perform this activity during a ransomware incident in AWS. 
+search: '`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended 
+|  stats count values(requestParameters.bucketName) as bucket_name values(resources{}.ARN) as resource_arn by src_ip aws_account_id awsRegion eventName userAgent user_arn userIdentity.principalId  errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_disable_bucket_versioning_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.
+references:
+- https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
+tags:
+  analytic_story:
+  - Suspicious AWS S3 Activities
+  - Data Exfiltration
+  asset_type: AWS Account
+  confidence: 80
+  impact: 80
+  message: Bucket Versioning is suspended for S3 buckets- $bucket_name$ by user $user_arn$ from IP address $src_ip$
+  mitre_attack_id:
+  - T1490
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - aws_account_id
+  - destinationLocationArn
+  - sourceLocationArn
+  - userAgent
+  - userIdentity.principalId
+  risk_score: 64
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
\ No newline at end of file

From 7127cfebe2b7d407b3c26e1fa859c8ddba699463 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 1 May 2023 18:19:31 -0700
Subject: [PATCH 15/20] validate fixes

---
 detections/cloud/aws_exfiltration_via_bucket_replication.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
index 8ccdfb283d..5d6d8b2727 100644
--- a/detections/cloud/aws_exfiltration_via_bucket_replication.yml
+++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
@@ -8,8 +8,7 @@ type: TTP
 data_source: []
 description: There have been reports of malicious actors using S3 bucket replication as a means of data exfiltration. This search detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\
 
-S3 bucket replication can also be used for cross-account replication, where data is replicated from a source 
-bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
+ S3 bucket replication can also be used for cross-account replication, where data is replicated from a source bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
 search: '`cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com
 |  rename requestParameters.* as * 
 | stats count values(bucketName) as source_bucket values(ReplicationConfiguration.Rule.ID) as rule_id values(ReplicationConfiguration.Rule.Destination.Bucket) as destination_bucket by _time user_arn userName user_type src_ip aws_account_id userIdentity.principalId user_agent | `aws_exfiltration_via_ec2_snapshot_filter`'
@@ -61,7 +60,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: true
\ No newline at end of file

From e682f813e65221ac1951789589845469dd2a9c1a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 4 May 2023 15:46:04 -0700
Subject: [PATCH 16/20] updates

---
 ...ation_via_anomalous_getobject_api_activity.yml | 15 ++++++++-------
 .../cloud/aws_exfiltration_via_ec2_snapshot.yml   |  7 ++-----
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
index d0d09ff98e..b69794f8e3 100644
--- a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
+++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
@@ -6,21 +6,22 @@ author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
 data_source: []
-description: This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making GetObject API calls to download objects from S3. 
-search: '`cloudtrail` eventName=GetObject | bin _time span=10m |  stats count values(requestParameters.bucketName) as bucketName by _time user_type user_arn userIdentity.principalId
-| anomalydetection "count" "user_type" "user_arn" action=annotate | `aws_exfiltration_via_anomalous_getobject_api_activity_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: It is possible that a user downloaded these files to use them locally.
+description: This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making high number of GetObject API calls to download objects from S3 by a user within 10 minutes of time window. The field `probable_cause` is the name of the field that best explains why the event is anomalous. This command identifies anomalous events by computing a probability for each GetObject event by "count" "user_type" "user_arn" and detects anomaly based on the frequencies.  
+search: '`cloudtrail` eventName=GetObject | bin _time span=10m |  stats count values(requestParameters.bucketName) as bucketName by _time src_ip aws_account_id user_type user_arn userIdentity.principalId
+| anomalydetection "count" "user_type" "user_arn" action=annotate | search probable_cause=* |`aws_exfiltration_via_anomalous_getobject_api_activity_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+known_false_positives: It is possible that a user downloaded these files to use them locally and there are AWS services in configured that perform these activities for a legitimate reason. Filter is needed. 
 references:
 - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Anomalydetection
+- https://www.vectra.ai/blogpost/abusing-the-replicator-silently-exfiltrating-data-with-the-aws-s3-replication-service
 tags:
   analytic_story:
   - Data Exfiltration
   asset_type: AWS Account
   confidence: 80
   impact: 80
-  message: Anomalous S3 activities detected by user $user_arn$ 
+  message: Anomalous S3 activities detected by user $user_arn$ from $src_ip$
   mitre_attack_id:
   - T1119
   observable:
diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
index 817b8b586d..6a5bb174d4 100644
--- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
+++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
@@ -2,15 +2,12 @@ name: AWS Exfiltration via EC2 Snapshot
 id: ac90b339-13fc-4f29-a18c-4abbba1f2171
 version: 1
 date: '2023-03-22'
-author: BHavin Patel, Splunk
+author: Bhavin Patel, Splunk
 status: production
 type: TTP
 data_source: []
 description: This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information. 
-search: '`cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip NOT IN ("guardduty.amazonaws.com")
-|  bin _time span=5m 
-|  stats count dc(eventName) as distinct_api_calls values(eventName)  values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id 
-| where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`'
+search: '`cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip !="guardduty.amazonaws.com" |  bin _time span=5m |  stats count dc(eventName) as distinct_api_calls values(eventName)  values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(userAgent) as userAgent by _time userName src_ip aws_account_id | where distinct_api_calls >= 2 | `aws_exfiltration_via_ec2_snapshot_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment. 
 known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization. 

From a442e23cf84b878418413f1fb566577dc8770596 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 4 May 2023 16:21:32 -0700
Subject: [PATCH 17/20] updating risk

---
 .../aws_ami_atttribute_modification_for_exfiltration.yml      | 4 ++++
 detections/cloud/aws_ec2_snapshot_shared_externally.yml       | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
index 29fd9d8bc9..02ccb02b05 100644
--- a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
+++ b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
@@ -40,6 +40,10 @@ tags:
     type: IP Address
     role:
     - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/cloud/aws_ec2_snapshot_shared_externally.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
index d04e474626..3a434a24c5 100644
--- a/detections/cloud/aws_ec2_snapshot_shared_externally.yml
+++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
@@ -39,6 +39,10 @@ tags:
     type: IP Address
     role:
     - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From ee2c44aba9fe87158510359b6d41417ce37a21a9 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 4 May 2023 17:10:36 -0700
Subject: [PATCH 18/20] aws correlation

---
 ...ws_s3_exfiltration_behavior_identified.yml | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 detections/cloud/aws_s3_exfiltration_behavior_identified.yml

diff --git a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
new file mode 100644
index 0000000000..1add63be06
--- /dev/null
+++ b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
@@ -0,0 +1,54 @@
+name: AWS S3 Exfiltration Behavior Identified
+id: 85096389-a443-42df-b89d-200efbb1b560
+version: 1
+date: '2023-05-04'
+author: Bhavin Patel, Splunk
+status: production
+type: Correlation
+data_source:  []
+description: This correlation search looks at the risk events created by the detection analytics related Collection and Exfiltration techniques used by adversaries. The rule is designed to identify instances where 2 or more analytics unique analytics and 2 or more distinct mitre IDs has triggered for a particular risk object. This alert when triggered may indicate a potential exfiltration in progress. By aggregating these analytics, security teams can swiftly respond to and investigate any suspicious activities, enhancing their ability to protect critical assets and prevent unauthorized access to sensitive information.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message  from datamodel=Risk.All_Risk where All_Risk.annotations.mitre_attack.mitre_tactic = "collection" OR All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration"  by All_Risk.risk_object
+| `drop_dm_object_name(All_Risk)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` | where source_count >= 2 and mitre_tactic_id_count>=2 | `aws_s3_exfiltration_behavior_identified_filter`'
+how_to_implement: You must enable all the detection searches in the Data Exfiltration Analytic story to create risk events in Enterprise Security.
+known_false_positives: alse positives may be present based on automated tooling or system administrators. Filter as needed.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
+- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
+tags:
+  analytic_story:
+  - Suspicious Cloud Instance Activities
+  - Data Exfiltration
+  asset_type: AWS Account
+  confidence: 90
+  impact: 90
+  message: Multiple AWS Exfiltration detections $source$ and techniques $All_Risk.annotations.mitre_attack.mitre_tactic_id$ trigged for risk object $risk_object$
+  mitre_attack_id:
+  - T1537
+  observable:
+  - name: risk_object
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object
+  - All_Risk.annotations.mitre_attack.mitre_tactic
+  - All_Risk.calculated_risk_score
+  - source
+  risk_score: 81
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_exfil_risk_events/aws_risk.log
+    sourcetype: stash
+    source: aws_exfil
+    update_timestamp: true

From a885bbb3007b36dbdb9fbc3892eaa127a096a04a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 4 May 2023 17:16:57 -0700
Subject: [PATCH 19/20] filter for aws

---
 detections/cloud/aws_s3_exfiltration_behavior_identified.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
index 1add63be06..6ee0bdda50 100644
--- a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
+++ b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
@@ -6,8 +6,8 @@ author: Bhavin Patel, Splunk
 status: production
 type: Correlation
 data_source:  []
-description: This correlation search looks at the risk events created by the detection analytics related Collection and Exfiltration techniques used by adversaries. The rule is designed to identify instances where 2 or more analytics unique analytics and 2 or more distinct mitre IDs has triggered for a particular risk object. This alert when triggered may indicate a potential exfiltration in progress. By aggregating these analytics, security teams can swiftly respond to and investigate any suspicious activities, enhancing their ability to protect critical assets and prevent unauthorized access to sensitive information.
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message  from datamodel=Risk.All_Risk where All_Risk.annotations.mitre_attack.mitre_tactic = "collection" OR All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration"  by All_Risk.risk_object
+description: This correlation search looks at the risk events created by the detection analytics related Collection and Exfiltration techniques used by adversaries. The rule is designed to identify instances where 2 or more analytics unique AWS analytics and 2 or more distinct mitre IDs has triggered for a particular risk object. This alert when triggered may indicate a potential exfiltration in progress. By aggregating these analytics, security teams can swiftly respond to and investigate any suspicious activities, enhancing their ability to protect critical assets and prevent unauthorized access to sensitive information.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message  from datamodel=Risk.All_Risk where All_Risk.annotations.mitre_attack.mitre_tactic = "collection" OR All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration" source = *AWS*  by All_Risk.risk_object
 | `drop_dm_object_name(All_Risk)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` | where source_count >= 2 and mitre_tactic_id_count>=2 | `aws_s3_exfiltration_behavior_identified_filter`'

From 5f1c38800a8d53a7207ac17c9991bb8c64199a8d Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 15 May 2023 12:52:17 -0700
Subject: [PATCH 20/20] search text updates

---
 detections/cloud/aws_disable_bucket_versioning.yml              | 2 +-
 .../aws_exfiltration_via_anomalous_getobject_api_activity.yml   | 2 +-
 detections/cloud/aws_exfiltration_via_bucket_replication.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml
index f1537d3c49..f173606b91 100644
--- a/detections/cloud/aws_disable_bucket_versioning.yml
+++ b/detections/cloud/aws_disable_bucket_versioning.yml
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
 data_source: []
-description: This searach looks for Cloudtrail events where bucket versioning is suspended by a user. Versioning allows the AWS Administrators to maintain different version of the S3 bucket which can be used to recover deleted data. Adversaries are seen to perform this activity during a ransomware incident in AWS. 
+description: The following analytic detects AWS cloudtrail events where bucket versioning is suspended by a user. Versioning allows the AWS Administrators to maintain different version of the S3 bucket which can be used to recover deleted data. Adversaries have leveraged this technique in the wild during a ransomware incident to disable versioning so the client cannot recover the data.
 search: '`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended 
 |  stats count values(requestParameters.bucketName) as bucket_name values(resources{}.ARN) as resource_arn by src_ip aws_account_id awsRegion eventName userAgent user_arn userIdentity.principalId  errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_disable_bucket_versioning_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
index b69794f8e3..060f38fe38 100644
--- a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
+++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
 data_source: []
-description: This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making high number of GetObject API calls to download objects from S3 by a user within 10 minutes of time window. The field `probable_cause` is the name of the field that best explains why the event is anomalous. This command identifies anomalous events by computing a probability for each GetObject event by "count" "user_type" "user_arn" and detects anomaly based on the frequencies.  
+description: This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making high number of GetObject API calls to download objects from S3 in a 10 minute time window. The field `probable_cause` is the name of the field that best explains why the event is anomalous. This command identifies anomalous events by computing a probability for each GetObject event by "count" "user_type" "user_arn" and detects anomaly based on the frequencies.  
 search: '`cloudtrail` eventName=GetObject | bin _time span=10m |  stats count values(requestParameters.bucketName) as bucketName by _time src_ip aws_account_id user_type user_arn userIdentity.principalId
 | anomalydetection "count" "user_type" "user_arn" action=annotate | search probable_cause=* |`aws_exfiltration_via_anomalous_getobject_api_activity_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
index 5d6d8b2727..542e552042 100644
--- a/detections/cloud/aws_exfiltration_via_bucket_replication.yml
+++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 status: production
 type: TTP
 data_source: []
-description: There have been reports of malicious actors using S3 bucket replication as a means of data exfiltration. This search detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\
+description: The following analytic detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\
 
  S3 bucket replication can also be used for cross-account replication, where data is replicated from a source bucket owned by one AWS account to a destination bucket owned by a different AWS account. 
 search: '`cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com