Merge pull request #487 from splunk/azuretest

Azure Scanning Story

detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-26"
+description: "This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
+known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness."
+name: "Kubernetes Azure detect most active service accounts by pod namespace"
+references: []
+search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_rbac_authorization_by_account.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-26"
+description: "This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 47af7d20-0607-4079-97d7-7a29af58b54e
+known_false_positives: "Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted."
+name: "Kubernetes Azure detect RBAC authorization by account"
+references: []
+search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason |stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_rbac_authorization_by_account_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_sensitive_object_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 1bba382b-07fd-4ffa-b390-8002739b76e8
+known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
+name: "Kubernetes Azure detect sensitive object access"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_sensitive_role_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: f27349e5-1641-4f6a-9e68-30402be0ad4c
+known_false_positives: "Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. "
+name: "Kubernetes Azure detect sensitive role access"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=clusterroles OR clusterrolebindings | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information on Kubernetes service accounts with failure or forbidden access status"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 019690d7-420f-4da0-b320-f27b09961514
+known_false_positives: "This search can give false positives as there might be inherent issues with authentications and permissions at cluster."
+name: "Kubernetes Azure detect service accounts forbidden failure access"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-26"
+description: "This search provides information on Kubectl calls with IP, verb namespace and object access context"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5
+known_false_positives: "Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets"
+name: "Kubernetes Azure detect suspicious kubectl calls"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_suspicious_kubectl_calls_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_pod_scan_fingerprint.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 86aad3e0-732f-4f66-bbbc-70df448e461d
+known_false_positives: "Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context."
+name: "Kubernetes Azure pod scan fingerprint"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Scanning Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Reconnaissance
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_scan_fingerprint.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-19"
+description: "This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: c5e5bd5c-1013-4841-8b23-e7b3253c840a
+known_false_positives: "Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context."
+name: "Kubernetes Azure scan fingerprint"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Scanning Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Reconnaissance
+  security_domain: threat
+type: ESCU
+version: 1

lookups/mitre_enrichment.csv

@@ -58,6 +58,9 @@ T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
 T1203,Exploitation for Client Execution,Execution,APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|APT29|Patchwork|TA459|Leviathan|Elderwood
 T1202,Indirect Command Execution,Defense Evasion,no
 T1215,Kernel Modules and Extensions,Persistence,no
+T1200,Hardware Additions,Initial Access,no
+T1208,Kerberoasting,Credential Access,no
+T1202,Indirect Command Execution,Defense Evasion,no
 T1201,Password Policy Discovery,Discovery,OilRig
 T1205,Port Knocking,Defense Evasion|Persistence|Command And Control,no
 T1190,Exploit Public-Facing Application,Initial Access,Soft Cell|Night Dragon|Axiom
@@ -70,6 +73,7 @@ T1206,Sudo Caching,Privilege Escalation,no
 T1199,Trusted Relationship,Initial Access,APT28|menuPass
 T1198,SIP and Trust Provider Hijacking,Defense Evasion|Persistence,no
 T1194,Spearphishing via Service,Initial Access,FIN6|OilRig|Dark Caracal|Magic Hound
+T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Turla|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Patchwork|APT29|Leviathan|Magic Hound|FIN8
 T1195,Supply Chain Compromise,Initial Access,APT41|Elderwood
 T1219,Remote Access Tools,Command And Control,Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
 T1216,Signed Script Proxy Execution,Defense Evasion|Execution,APT32
@@ -127,6 +131,9 @@ T1150,Plist Modification,Defense Evasion|Persistence|Privilege Escalation,no
 T1145,Private Keys,Credential Access,no
 T1167,Securityd Memory,Credential Access,no
 T1166,Setuid and Setgid,Privilege Escalation|Persistence,no
+T1153,Source,Execution,no
+T1164,Re-opened Applications,Persistence,no
+T1154,Trap,Execution|Persistence,no
 T1165,Startup Items,Persistence|Privilege Escalation,no
 T1169,Sudo,Privilege Escalation,no
 T1153,Source,Execution,no
@@ -212,7 +219,7 @@ T1057,Process Discovery,Discovery,Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper
 T1056,Input Capture,Collection|Credential Access,APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Magic Hound|Sowbug|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
 T1055,Process Injection,Defense Evasion|Privilege Escalation,APT41|Kimsuky|Tropic Trooper|Threat Group-3390|APT37|Gorgon Group|Turla|Cobalt Group|Honeybee|Lazarus Group|PLATINUM|Putter Panda
 T1054,Indicator Blocking,Defense Evasion,no
-T1053,Scheduled Task,Execution|Persistence|Privilege Escalation,APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Dragonfly 2.0|OilRig|Rancor|Patchwork|FIN8|BRONZE BUTLER|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|Threat Group-3390|APT18|APT3|APT29
+T1053,Scheduled Task,Execution|Persistence|Privilege Escalation,APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Dragonfly 2.0|Patchwork|OilRig|Rancor|FIN8|BRONZE BUTLER|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|Threat Group-3390|APT18|APT3|APT29
 T1052,Exfiltration Over Physical Medium,Exfiltration,no
 T1051,Shared Webroot,Lateral Movement,no
 T1050,New Service,Persistence|Privilege Escalation,Kimsuky|Tropic Trooper|Cobalt Group|Threat Group-3390|Ke3chang|FIN7|APT32|APT3|Lazarus Group|Carbanak
@@ -260,7 +267,7 @@ T1009,Binary Padding,Defense Evasion,Patchwork|APT32|Leviathan|BRONZE BUTLER|Moa
 T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
 T1007,System Service Discovery,Discovery,APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
 T1006,File System Logical Offsets,Defense Evasion,no
-T1005,Data from Local System,Collection,Kimsuky|Soft Cell|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
+T1005,Data from Local System,Collection,Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
 T1004,Winlogon Helper DLL,Persistence,Tropic Trooper|Turla
 T1003,Credential Dumping,Credential Access,APT41|Soft Cell|TEMP.Veles|APT33|Leviathan|APT39|Stolen Pencil|APT32|Night Dragon|Dragonfly 2.0|Leafminer|Lazarus Group|Magic Hound|APT37|PLATINUM|MuddyWater|FIN8|Sowbug|BRONZE BUTLER|OilRig|FIN5|menuPass|Strider|Patchwork|Stealth Falcon|Suckfly|FIN6|Poseidon Group|Threat Group-3390|APT3|Molerats|APT28|APT1|Ke3chang|Cleaver|Axiom
 T1002,Data Compressed,Exfiltration,APT41|Soft Cell|Gallmaker|APT33|APT32|APT39|MuddyWater|Honeybee|APT28|Magic Hound|Dragonfly 2.0|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT1|Ke3chang

macros/kubernetes_azure.yml

@@ -0,0 +1,3 @@
+definition: sourcetype=mscs:storage:blob:json
+description: customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
+name: kubernetes_azure

macros/kubernetes_azure_detect_RBAC_authorization_by_account.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_rbac_authorization_by_account_filter

macros/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter

macros/kubernetes_azure_detect_sensitive_object_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_sensitive_object_access_filter

macros/kubernetes_azure_detect_sensitive_role_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_sensitive_role_access_filter

macros/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter

macros/kubernetes_azure_detect_suspicious_kubectl_calls.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_suspicious_kubectl_calls_filter

macros/kubernetes_azure_pod_scan_fingerprint_detection_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_pod_scan_fingerprint_detection_filter

macros/kubernetes_azure_scan_fingerprint_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_scan_fingerprint_filter

package/default/analytic_stories.conf

@@ -496,7 +496,7 @@ modification_date = 2020-04-15
 id = a9ef59cf-e981-4e66-9eef-bb049f695c09
 version = 1
 reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
-detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule"]
+detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"]
 mappings = {"kill_chain_phases": ["Reconnaissance"]}
 investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - GCP Kubernetes activity by src ip", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History"]
 support_searches = []
@@ -505,6 +505,38 @@ providing_technologies = none
 description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
 narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster.
 
+[Kubernetes Sensitive Object Access Activity]
+category =  Cloud Security
+creation_date = 2020-05-20
+modification_date = 2020-05-20
+id = 2574e6d9-7254-4751-8925-0447deeec8ea
+version = 1
+reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
+detection_searches = ["ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule"]
+mappings = {"kill_chain_phases": ["Lateral Movement"]}
+investigative_searches = ["ESCU - Get Notable Info"]
+support_searches = []
+data_models = []
+providing_technologies = none
+description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
+narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
+
+[Kubernetes Sensitive Role Activity]
+category =  Cloud Security
+creation_date = 2020-05-20
+modification_date = 2020-05-20
+id = 2574e6d9-7254-4751-8925-0447deeec8ew
+version = 1
+reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
+detection_searches = ["ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule"]
+mappings = {"kill_chain_phases": ["Lateral Movement"]}
+investigative_searches = ["ESCU - Get Notable Info"]
+support_searches = []
+data_models = []
+providing_technologies = none
+description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
+narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
+
 [Lateral Movement]
 category =  Adversary Tactics
 creation_date = 2020-02-04
@@ -762,7 +794,7 @@ version = 1
 reference = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"]
 detection_searches = ["ESCU - SQL Injection with Long URLs - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1043"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Notable History"]
 support_searches = []
 data_models = ["Web"]
 providing_technologies = none
@@ -1070,7 +1102,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
-investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By ARN"]
 support_searches = ["ESCU - Previously Seen EC2 Modifications By User"]
 data_models = []
 providing_technologies = none

package/default/es_investigations.conf

@@ -237,7 +237,7 @@ panels = ["panel://workbench_panel_get_authentication_logs_for_endpoint", "panel
 label = SQL Injection
 description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
 disabled = 0
-panels = ["panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_samsam_ransomware]
 label = SamSam Ransomware
@@ -339,7 +339,7 @@ panels = ["panel://workbench_panel_get_process_registry_activity", "panel://work
 label = Unusual AWS EC2 Modifications
 description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
 disabled = 0
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 
 [panel_group://workbench_panel_group_unusual_processes]
 label = Unusual Processes

package/default/macros.conf

@@ -106,6 +106,42 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
 description = This macro limits the output to process names that are in the Windows System directory
 
+[kubernetes_azure]
+definition = sourcetype=mscs:storage:blob:json
+description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_sensitive_object_access_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_sensitive_role_access_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_pod_scan_fingerprint_detection_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_scan_fingerprint_filter]
+definition = search *
+description = Use this macro to add additional filters
+
 [netbackup]
 definition = sourcetype="netbackup_logs"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -631,6 +667,38 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[kubernetes_azure_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_pod_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [large_volume_of_dns_any_queries_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

package/default/savedsearches.conf

@@ -4208,6 +4208,318 @@ realtime_schedule = 0
 is_visible = false
 search = | from datamodel Identity_Management.All_Identities  | eval empStatus=case((now()-startDate)<604800, "Accounts created in last week") | search empStatus="Accounts created in last week"| `security_content_ctime(endDate)` | `security_content_ctime(startDate)`| table identity empStatus endDate startDate | `identify_new_user_accounts_filter`
 
+[ESCU - Kubernetes Azure detect RBAC authorization by account - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted.
+action.escu.creation_date = 2020-05-26
+action.escu.modification_date = 2020-05-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect RBAC authorization by account - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect RBAC authorization by account - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+action.notable.param.rule_title = Kubernetes Azure detect RBAC authorization by account
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason |stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_rbac_authorization_by_account_filter`
+
+[ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness.
+action.escu.creation_date = 2020-05-26
+action.escu.modification_date = 2020-05-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+action.notable.param.rule_title = Kubernetes Azure detect most active service accounts by pod namespace
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`
+
+[ESCU - Kubernetes Azure detect sensitive object access - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive object access - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect sensitive object access - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.notable.param.rule_title = Kubernetes Azure detect sensitive object access
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`
+
+[ESCU - Kubernetes Azure detect sensitive role access - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. 
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive role access - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect sensitive role access - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.notable.param.rule_title = Kubernetes Azure detect sensitive role access
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=clusterroles OR clusterrolebindings | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`
+
+[ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes service accounts with failure or forbidden access status
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes service accounts with failure or forbidden access status
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes service accounts with failure or forbidden access status
+action.notable.param.rule_title = Kubernetes Azure detect service accounts forbidden failure access
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter`
+
+[ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubectl calls with IP, verb namespace and object access context
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubectl calls with IP, verb namespace and object access context
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets
+action.escu.creation_date = 2020-05-26
+action.escu.modification_date = 2020-05-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubectl calls with IP, verb namespace and object access context
+action.notable.param.rule_title = Kubernetes Azure detect suspicious kubectl calls
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_suspicious_kubectl_calls_filter`
+
+[ESCU - Kubernetes Azure pod scan fingerprint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure pod scan fingerprint - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Scanning Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure pod scan fingerprint - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+action.notable.param.rule_title = Kubernetes Azure pod scan fingerprint
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter`
+
+[ESCU - Kubernetes Azure scan fingerprint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
+action.escu.creation_date = 2020-05-19
+action.escu.modification_date = 2020-05-19
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure scan fingerprint - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Scanning Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure scan fingerprint - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+action.notable.param.rule_title = Kubernetes Azure scan fingerprint
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_filter`
+
 [ESCU - Large Volume of DNS ANY Queries - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -9080,7 +9392,7 @@ action.escu.full_search_name = ESCU - Get Notable Info
 description = This search queries the notable index to retrieve detailed information captured within the notable. Every notable has a unique ID associated with it, which is used to point us directly to the notable event under investigation.
 action.escu.creation_date = 2017-09-20
 action.escu.modification_date = 2017-09-20
-action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "AWS User Monitoring", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "Cloud Cryptomining", "Collection and Staging", "Command and Control", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Kubernetes Scanning Activity", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Web Fraud Detection", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
+action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "AWS User Monitoring", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "Cloud Cryptomining", "Collection and Staging", "Command and Control", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Kubernetes Scanning Activity", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Web Fraud Detection", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Kubernetes Sensitive Role Activity", "Kubernetes Sensitive Object Access Activity"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []

package/default/use_case_library.conf

@@ -370,6 +370,28 @@ searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GC
 description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
 narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster.
 
+[analytic_story://Kubernetes Sensitive Object Access Activity]
+category = Cloud Security
+last_updated = 2020-05-20
+version = 1
+references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
+spec_version = 3
+searches = ["ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Get Notable Info"]
+description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
+narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
+
+[analytic_story://Kubernetes Sensitive Role Activity]
+category = Cloud Security
+last_updated = 2020-05-20
+version = 1
+references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
+spec_version = 3
+searches = ["ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Get Notable Info"]
+description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
+narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
+
 [analytic_story://Lateral Movement]
 category = Adversary Tactics
 last_updated = 2020-02-04
@@ -475,7 +497,7 @@ version = 1
 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}]
 spec_version = 3
-searches = ["ESCU - Detect Oulook exe writing a  zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Detect Oulook exe writing a  zip file - Rule", "ESCU - Get Parent Process Info"]
 description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.
 narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \
 As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \
@@ -565,7 +587,7 @@ version = 1
 references = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Notable History"]
+searches = ["ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Notable History"]
 description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
 narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\
 This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.
@@ -788,7 +810,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History"]
+searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By ARN"]
 description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
 narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \
  Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior.
@@ -2010,6 +2032,86 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1136"], "nist": ["PR.IP"]
 known_false_positives = If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately.
 providing_technologies = []
 
+[savedsearch://ESCU - Kubernetes Azure detect RBAC authorization by account - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Lateral Movement"]}
+known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted.
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Lateral Movement"]}
+known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness.
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure detect sensitive object access - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Lateral Movement"]}
+known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure detect sensitive role access - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Lateral Movement"]}
+known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. 
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information on Kubernetes service accounts with failure or forbidden access status
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Lateral Movement"]}
+known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information on Kubectl calls with IP, verb namespace and object access context
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Lateral Movement"]}
+known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure pod scan fingerprint - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Reconnaissance"]}
+known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Azure scan fingerprint - Rule]
+type = detection
+asset_type = Azure AKS Kubernetes cluster
+confidence = medium
+explanation = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+annotations = {"kill_chain_phases": ["Reconnaissance"]}
+known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
+providing_technologies = []
+
 [savedsearch://ESCU - Large Volume of DNS ANY Queries - Rule]
 type = detection
 asset_type = DNS Servers

response_tasks/get_notable_info.yml

@@ -67,3 +67,5 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Service Abuse
+  - Kubernetes Sensitive Role Activity
+  - Kubernetes Sensitive Object Access Activity

stories/kubernetes_scanning_activity.yml

@@ -1,20 +1,15 @@
-name: Kubernetes Scanning Activity
+author: "Rod Soto, Splunk"
+date: "2020-04-15"
+description: "This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names."
 id: a9ef59cf-e981-4e66-9eef-bb049f695c09
-version: 1
-date: '2020-04-15'
-description: This story addresses detection against Kubernetes cluster fingerprint
-  scan and attack by providing information on items such as source ip, user agent,
-  cluster names.
-narrative: Kubernetes is the most used container orchestration platform, this orchestration
-  platform contains sensitve information and management priviledges of production
-  workloads, microservices and applications. These searches allow operator to detect
-  suspicious unauthenticated requests from the internet to kubernetes cluster.
-author: Rod Soto, Splunk
-type: ESCU
+name: "Kubernetes Scanning Activity"
+narrative: "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster."
 references:
-- https://github.com/splunk/cloud-datamodel-security-research
+  - "https://github.com/splunk/cloud-datamodel-security-research"
 tags:
-  analytics_story: Kubernetes Scanning Activity
-  usecase: Security Monitoring
+  analytics_story: "Kubernetes Scanning Activity"
   category:
-  - Cloud Security
+    - "Cloud Security"
+  usecase: "Security Monitoring"
+type: ESCU
+version: 1

stories/kubernetes_sensitive_object_access_activity.yml

@@ -0,0 +1,15 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason."
+id: 2574e6d9-7254-4751-8925-0447deeec8ea
+name: "Kubernetes Sensitive Object Access Activity"
+narrative: "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects."
+references:
+  - https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+tags:
+  analytics_story: "Kubernetes Sensitive Object Access Activity"
+  category:
+    - "Cloud Security"
+  usecase: "Security Monitoring"
+type: ESCU
+version: 1

stories/kubernetes_sensitive_role_activity.yml

@@ -0,0 +1,15 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces."
+id: 2574e6d9-7254-4751-8925-0447deeec8ew
+name: "Kubernetes Sensitive Role Activity"
+narrative: "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities"
+references:
+  - https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+tags:
+  analytics_story: "Kubernetes Sensitive Role Activity"
+  category:
+    - "Cloud Security"
+  usecase: "Security Monitoring"
+type: ESCU
+version: 1