admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

validate

Browse Source
This commit is contained in:
bpatel
2021-03-09 16:58:01 -08:00
parent 1f81838841
commit 92bd73e301
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_createloginprofile.yml
+2 -2
View File
@@ -6,11 +6,11 @@ author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
search: 'index=aws_all eventName = CreateLoginProfile
search: '`cloudtrail` eventName = CreateLoginProfile
| rename requestParameters.userName as new_login_profile
| table src_ip eventName new_login_profile userName
| join new_login_profile src_ip
[| search index=aws_all eventName = ConsoleLogin
[| search `cloudtrail` eventName = ConsoleLogin
| rename userName as new_login_profile | table eventName new_login_profile src_ip ]`aws_createloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
detections/cloud/aws_updateloginprofile.yml
+1 -1
View File
@@ -1,5 +1,5 @@
name: AWS UpdateLoginProfile
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
version: 1
date: '2021-03-02'
author: Bhavin Patel, Splunk
stories/aws_iam_privilege_escalation.yml
+1 -1
View File
@@ -1,5 +1,5 @@
name: AWS IAM Privilege Escalation
id: ced74200-8465-4bc3-bd2c-9a782eec6750
id: ced74200-8465-4bc3-bd2c-22782eec6750
version: 1
date: '2021-03-08'
author: David Dorsey, Splunk