Branch was auto-updated.

bin/docker_detection_tester/detection_testing_execution.py

@@ -1,7 +1,7 @@
 import argparse
 import copy
 import csv
-from ctypes.wintypes import tagRECT
+# from ctypes.wintypes import tagRECT
 import json
 import os
 import queue

detections/cloud/aws_credential_access_failed_login.yml

@@ -15,7 +15,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/001/
 tags:
   analytic_story:
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   cis20:
   - CIS 3

detections/cloud/aws_credential_access_getpassworddata.yml

@@ -15,7 +15,7 @@ references:
 - https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
 tags:
   analytic_story:
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   cis20:
   - CIS 3

detections/cloud/aws_credential_access_rds_password_reset.yml

@@ -17,7 +17,7 @@ references:
 - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
 tags:
   analytic_story:
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   cis20:
   - CIS 3

detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml

@@ -0,0 +1,61 @@
+name: AWS Multiple Users Failing To Authenticate From Ip
+id: 71e1fb89-dd5f-4691-8523-575420de4630
+version: 1
+date: '2022-09-27'
+author: Bhavin Patel
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
+known_false_positives: No known false postives for this detection. Please review this alert
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
+- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
+tags:
+  analytic_story:
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - action
+  - eventName
+  - src_ip
+  risk_score: 54
+  security_domain: threat

detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml

@@ -0,0 +1,65 @@
+name: AWS Unusual Number of Failed Authentications From Ip
+id: 0b5c9c2b-e2cb-4831-b4f1-af125ceb1386
+version: 1
+date: '2022-09-26'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. 
+  The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. 
+  While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`.
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip
+| eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip 
+| eval  upperBound=(ip_avg+ip_std*3) 
+| eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment
+known_false_positives: No known false postives for this detection. Please review this alert
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
+- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
+tags:
+  analytic_story:
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - action
+  - eventName
+  - src_ip
+  risk_score: 54
+  security_domain: threat

detections/cloud/azure_ad_multi_factor_authentication_disabled.yml

@@ -8,7 +8,7 @@ datamodel: []
 description: The following analytic identifies an attempt to disable multi-factor authentication for an Azure AD user. An adversary who has obtained access to an Azure AD tenant 
   may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account.
   This way the attackers can keep persistance in the environment without adding new users.
-search: '`azuread` "body.operationName"="Disable Strong Authentication" 
+search: '`azuread` body.category=AuditLogs body.operationName="Disable Strong Authentication" 
   | rename body.properties.* as *
   | rename targetResources{}.userPrincipalName as userPrincipalName
   | rename targetResources{}.type as type

detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

@@ -11,14 +11,14 @@ description: 'The following analytic identifies one source Ip failing to authent
 
   Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.'
 
-search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+search: ' `azuread` body.category= SignInLogs body.properties.status.errorCode=50126 body.properties.authenticationDetails{}.succeeded= false 
   | rename body.properties.* as *
   | bucket span=5m _time
   | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
   | where unique_accounts > 30
   | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
-  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs.
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
   log category.
 known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
 references:

detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml

@@ -18,13 +18,13 @@ description: 'The following analytic identifies one source Ip failing to authent
   While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage.
   A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.'
 
-search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50126 body.properties.authenticationDetails{}.succeeded= false 
   | rename body.properties.* as *
   | bucket span=5m _time
   | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
   | eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress
   | eval  upperBound=(ip_avg+ip_std*3)
-  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1
   | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
   log category.

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -1,6 +1,6 @@
 name: Detect AWS Console Login by New User
 id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
-version: 2
+version: 3
 date: '2022-05-10'
 author: Rico Valdez, Splunk
 type: Hunting
@@ -13,7 +13,7 @@ description: This search looks for AWS CloudTrail events wherein a console login
   the last hour
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
-  | join user type=outer [ inputlookup previously_seen_users_console_logins | stats
+  | join user type=outer [ | inputlookup previously_seen_users_console_logins | stats
   min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),
   "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
   Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
@@ -32,10 +32,12 @@ references: []
 tags:
   analytic_story:
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16
+  mitre_attack_id:
+  - T1552
   confidence: 60
   context:
   - Source:Cloud Data

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -44,7 +44,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -45,7 +45,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -44,7 +44,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16

stories/aws_credential_access.yml

@@ -1,18 +0,0 @@
-name: AWS Credential Access
-id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9
-version: 1
-date: '2022-08-19'
-author: Gowthamaraj Rajendran, Bhavin Patel,  Splunk
-description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.
-narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities.
-references:
-- https://attack.mitre.org/tactics/TA0006/
-tags:
-  analytic_story: AWS Credential Access
-  category:
-  - Cloud Security
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Security Monitoring

stories/aws_identity_and_access_management_account_takeover.yml

@@ -0,0 +1,19 @@
+name: AWS Identity and Access Management Account Takeover
+id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9
+version: 2
+date: '2022-08-19'
+author: Gowthamaraj Rajendran, Bhavin Patel,  Splunk
+description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.
+narrative: Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. 
+  Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities.
+references:
+- https://attack.mitre.org/tactics/TA0006/
+tags:
+  analytic_story: AWS Identity and Access Management Account Takeover
+  category:
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: AWS Multiple Users Failing To Authenticate From Ip Unit Test
+tests:
+- name: AWS Multiple Users Failing To Authenticate From Ip
+  file: cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true

tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: AWS Unusual Number of Failed Authentications From Ip Unit Test
+tests:
+- name: AWS Unusual Number of Failed Authentications From Ip
+  file: cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -7d
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true