From 9655f9245add52ba3afdcdb6f5029f3104f87ad9 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Nov 2020 22:19:34 +0000 Subject: [PATCH] Added detection testing service results inCloud Compute Instance Created In Previously Unused Region --- ...ce_created_in_previously_unused_region.yml | 35 ++++++++++--------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 0a39901b27..59e9fc897d 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -5,24 +5,24 @@ date: '2020-09-02' description: This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. -how_to_implement: "You must be ingesting your cloud infrastructure logs from your - cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` - to build the initial table of images observed and times. You must also enable the second - baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and - to age out old data. You can also provide additional filtering for this search by - customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro." +how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud + provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` + to build the initial table of images observed and times. You must also enable the + second baseline search `Previously Seen Cloud Regions - Update` to keep this table + up to date and to age out old data. You can also provide additional filtering for + this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` + macro. type: ESCU references: [] author: David Dorsey, Splunk -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user -| `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenRegion=min(firstTimeSeen) -| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") -| table firstTime, user, dest, count , vendor_region -| `security_content_ctime(firstTime)` -| `cloud_compute_instance_created_in_previously_unused_region_filter`' +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) + as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, + All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions + vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats + max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) + | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), + "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` + | `cloud_compute_instance_created_in_previously_unused_region_filter`' known_false_positives: It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. tags: @@ -42,5 +42,6 @@ tags: risk_score: 20 risk_object_type: user risk_object: user - - + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json