From a1023ca8398a4fcc31b759ade778a646dacb9bb8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Sep 2022 19:26:11 -0500 Subject: [PATCH 01/10] rename to account takeover --- detections/cloud/aws_credential_access_failed_login.yml | 2 +- detections/cloud/aws_credential_access_getpassworddata.yml | 2 +- .../cloud/aws_credential_access_rds_password_reset.yml | 2 +- ...ross_account_activity_from_previously_unseen_account.yml | 1 + detections/cloud/detect_aws_console_login_by_new_user.yml | 4 +++- .../detect_aws_console_login_by_user_from_new_city.yml | 2 +- .../detect_aws_console_login_by_user_from_new_country.yml | 2 +- .../detect_aws_console_login_by_user_from_new_region.yml | 2 +- .../{aws_credential_access.yml => aws_account_takeover.yml} | 6 +++--- 9 files changed, 13 insertions(+), 10 deletions(-) rename stories/{aws_credential_access.yml => aws_account_takeover.yml} (57%) diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index dea0c9dfa6..67c22fad67 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -15,7 +15,7 @@ references: - https://attack.mitre.org/techniques/T1110/001/ tags: analytic_story: - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index 8b3402e2e1..d32423f4ed 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -15,7 +15,7 @@ references: - https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/ tags: analytic_story: - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 7346657dec..2e023dd99d 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -17,7 +17,7 @@ references: - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds tags: analytic_story: - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index a636c30be9..d9e716f24c 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -32,6 +32,7 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities + - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 268265bc68..21edd3ffc8 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -32,10 +32,12 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 + mitre_attack_id: + - T1552 confidence: 60 context: - Source:Cloud Data diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index e1f112c9d6..266569f814 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -44,7 +44,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 2f1fe53c8a..ca0554dbf7 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -45,7 +45,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index f6ac8156d4..e05b9cb38f 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -44,7 +44,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - - AWS Credential Access + - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/stories/aws_credential_access.yml b/stories/aws_account_takeover.yml similarity index 57% rename from stories/aws_credential_access.yml rename to stories/aws_account_takeover.yml index 24ae012a03..b39d699d48 100644 --- a/stories/aws_credential_access.yml +++ b/stories/aws_account_takeover.yml @@ -1,14 +1,14 @@ -name: AWS Credential Access +name: AWS Account Takeover id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9 version: 1 date: '2022-08-19' author: Gowthamaraj Rajendran, Bhavin Patel, Splunk description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. -narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities. +narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities. references: - https://attack.mitre.org/tactics/TA0006/ tags: - analytic_story: AWS Credential Access + analytic_story: AWS Account Takeover category: - Cloud Security product: From 819b016b375ed03e9d724fe2f83f6f2d334b922e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 14 Sep 2022 18:24:59 -0500 Subject: [PATCH 02/10] search updaate and remove import --- bin/docker_detection_tester/detection_testing_execution.py | 2 +- detections/cloud/detect_aws_console_login_by_new_user.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 4df19e5037..31b024a7fd 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -1,7 +1,7 @@ import argparse import copy import csv -from ctypes.wintypes import tagRECT +# from ctypes.wintypes import tagRECT import json import os import queue diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 21edd3ffc8..d61ec70dba 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -1,6 +1,6 @@ name: Detect AWS Console Login by New User id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 -version: 2 +version: 3 date: '2022-05-10' author: Rico Valdez, Splunk type: Hunting @@ -13,7 +13,7 @@ description: This search looks for AWS CloudTrail events wherein a console login the last hour search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` - | join user type=outer [ inputlookup previously_seen_users_console_logins | stats + | join user type=outer [ | inputlookup previously_seen_users_console_logins | stats min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)` @@ -32,7 +32,7 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - - AWS Account Takeover + - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 From 0c0603e7010952a0fee78b1f3f0bca844db563d8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 26 Sep 2022 15:56:29 -0500 Subject: [PATCH 03/10] password spray detection std dev --- ...mber_of_failed_authentications_from_ip.yml | 65 +++++++++++++++++++ ...of_failed_authentications_from_ip.test.yml | 13 ++++ 2 files changed, 78 insertions(+) create mode 100644 detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml create mode 100644 tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..4ed32de1bb --- /dev/null +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,65 @@ +name: AWS Unusual Number of Failed Authentications From Ip +id: 0b5c9c2b-e2cb-4831-b4f1-af125ceb1386 +version: 1 +date: '2022-09-26' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: [] +description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. +The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. +While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip +| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip +| eval upperBound=(ip_avg+ip_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment +known_false_positives: No known false postives for this detection. Please review this alert +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ +tags: + analytic_story: + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + impact: 60 + kill_chain_phases: + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: tried_accounts + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - user + - action + - eventName + - src_ip + risk_score: 54 + security_domain: threat diff --git a/tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..e1d36861c5 --- /dev/null +++ b/tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: AWS Unusual Number of Failed Authentications From Ip Unit Test +tests: +- name: AWS Unusual Number of Failed Authentications From Ip + file: cloud/aws_unusual_number_of_failed_authentications_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -7d + latest_time: now + attack_data: + - file_name: aws_cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true From 86c4816f98957bd7b1dd7abd7ade441dc22c2b9f Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 26 Sep 2022 16:25:49 -0500 Subject: [PATCH 04/10] nnew detection and multiple searches --- .../aws_credential_access_failed_login.yml | 2 +- .../aws_credential_access_getpassworddata.yml | 2 +- ...s_credential_access_rds_password_reset.yml | 2 +- ...ctivity_from_previously_unseen_account.yml | 1 - ..._users_failing_to_authenticate_from_ip.yml | 62 +++++++++++++++++++ ...mber_of_failed_authentications_from_ip.yml | 2 +- .../detect_aws_console_login_by_new_user.yml | 2 +- ...ws_console_login_by_user_from_new_city.yml | 2 +- ...console_login_by_user_from_new_country.yml | 2 +- ..._console_login_by_user_from_new_region.yml | 2 +- stories/aws_account_takeover.yml | 18 ------ ...and_access_management_account_takeover.yml | 19 ++++++ ...s_failing_to_authenticate_from_ip.test.yml | 13 ++++ 13 files changed, 102 insertions(+), 27 deletions(-) create mode 100644 detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml delete mode 100644 stories/aws_account_takeover.yml create mode 100644 stories/aws_identity_and_access_management_account_takeover.yml create mode 100644 tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml index 67c22fad67..f3ba0c78a0 100644 --- a/detections/cloud/aws_credential_access_failed_login.yml +++ b/detections/cloud/aws_credential_access_failed_login.yml @@ -15,7 +15,7 @@ references: - https://attack.mitre.org/techniques/T1110/001/ tags: analytic_story: - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index d32423f4ed..4985d40b74 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -15,7 +15,7 @@ references: - https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/ tags: analytic_story: - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml index 2e023dd99d..0ba6b0bf6c 100644 --- a/detections/cloud/aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/aws_credential_access_rds_password_reset.yml @@ -17,7 +17,7 @@ references: - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds tags: analytic_story: - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index d9e716f24c..a636c30be9 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -32,7 +32,6 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - - AWS Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml new file mode 100644 index 0000000000..630174e545 --- /dev/null +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -0,0 +1,62 @@ +name: AWS Multiple Users Failing To Authenticate From Ip +id: 71e1fb89-dd5f-4691-8523-575420de4630 +version: 1 +date: '2022-09-26' +author: Bhavin Patel +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent +| where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. +known_false_positives: No known false postives for this detection. Please review this alert +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ +tags: + analytic_story: + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + impact: 60 + kill_chain_phases: + - Exploitation + message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$ + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: tried_accounts + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - user + - action + - eventName + - src_ip + risk_score: 54 + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 4ed32de1bb..04a2796d46 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -37,7 +37,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: UPDATE message + message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$ mitre_attack_id: - T1003.002 nist: diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index d61ec70dba..53bb8272de 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -32,7 +32,7 @@ references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 266569f814..497e808482 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -44,7 +44,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index ca0554dbf7..58211f1cc2 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -45,7 +45,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index e05b9cb38f..b423a1574d 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -44,7 +44,7 @@ tags: analytic_story: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - - AWS Account Takeover + - AWS Identity and Access Management Account Takeover asset_type: AWS Instance cis20: - CIS 16 diff --git a/stories/aws_account_takeover.yml b/stories/aws_account_takeover.yml deleted file mode 100644 index b39d699d48..0000000000 --- a/stories/aws_account_takeover.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: AWS Account Takeover -id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9 -version: 1 -date: '2022-08-19' -author: Gowthamaraj Rajendran, Bhavin Patel, Splunk -description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. -narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities. -references: -- https://attack.mitre.org/tactics/TA0006/ -tags: - analytic_story: AWS Account Takeover - category: - - Cloud Security - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Security Monitoring diff --git a/stories/aws_identity_and_access_management_account_takeover.yml b/stories/aws_identity_and_access_management_account_takeover.yml new file mode 100644 index 0000000000..a450d03ded --- /dev/null +++ b/stories/aws_identity_and_access_management_account_takeover.yml @@ -0,0 +1,19 @@ +name: AWS Identity and Access Management Account Takeover +id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9 +version: 2 +date: '2022-08-19' +author: Gowthamaraj Rajendran, Bhavin Patel, Splunk +description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. +narrative: Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. +Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities. +references: +- https://attack.mitre.org/tactics/TA0006/ +tags: + analytic_story: AWS Identity and Access Management Account Takeover + category: + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring diff --git a/tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml b/tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml new file mode 100644 index 0000000000..f610876bef --- /dev/null +++ b/tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml @@ -0,0 +1,13 @@ +name: AWS Multiple Users Failing To Authenticate From Ip Unit Test +tests: +- name: AWS Multiple Users Failing To Authenticate From Ip + file: cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true From db9068b4fb7c0f044488e1e908cc2b4ec302d85f Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 26 Sep 2022 16:50:02 -0500 Subject: [PATCH 05/10] updating azure --- ...zure_ad_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index ded1815871..c60d8b286d 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -24,7 +24,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress | eval upperBound=(ip_avg+ip_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. From 84ad82a95f579c681c3c3c43fe07a1a562f70363 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 26 Sep 2022 16:52:35 -0500 Subject: [PATCH 06/10] yml error --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- .../aws_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 630174e545..b489c1aaf8 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -39,7 +39,7 @@ tags: - T1003.002 nist: - DE.CM - observable: + observable: - name: src_ip type: IP Address role: diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 04a2796d46..b41393ef37 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -42,7 +42,7 @@ tags: - T1003.002 nist: - DE.CM - observable: + observable: - name: src_ip type: IP Address role: From f1d93ba5af606879b65d177aac9428778240a700 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 26 Sep 2022 17:05:51 -0500 Subject: [PATCH 07/10] format updates --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 3 +-- ...aws_unusual_number_of_failed_authentications_from_ip.yml | 6 +++--- .../aws_identity_and_access_management_account_takeover.yml | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index b489c1aaf8..14dc186d33 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -7,8 +7,7 @@ type: Anomaly datamodel: - Endpoint description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent -| where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives: No known false postives for this detection. Please review this alert references: diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index b41393ef37..46c7d959e6 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -5,9 +5,9 @@ date: '2022-09-26' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. -The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. -While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`. +description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. + The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. + While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`. search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip | eval upperBound=(ip_avg+ip_std*3) diff --git a/stories/aws_identity_and_access_management_account_takeover.yml b/stories/aws_identity_and_access_management_account_takeover.yml index a450d03ded..33dd525e2d 100644 --- a/stories/aws_identity_and_access_management_account_takeover.yml +++ b/stories/aws_identity_and_access_management_account_takeover.yml @@ -5,7 +5,7 @@ date: '2022-08-19' author: Gowthamaraj Rajendran, Bhavin Patel, Splunk description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. narrative: Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. -Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities. + Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities. references: - https://attack.mitre.org/tactics/TA0006/ tags: From 74f1fe7180bbcec12217d468fa8f816102c926c8 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 27 Sep 2022 15:31:24 -0400 Subject: [PATCH 08/10] minor changes on SPL --- .../cloud/azure_ad_multi_factor_authentication_disabled.yml | 2 +- ...zure_ad_multiple_users_failing_to_authenticate_from_ip.yml | 4 ++-- ...re_ad_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index 21b7bab24b..671367235c 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies an attempt to disable multi-factor authentication for an Azure AD user. An adversary who has obtained access to an Azure AD tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users. -search: '`azuread` "body.operationName"="Disable Strong Authentication" +search: '`azuread` body.category=AuditLogs body.operationName="Disable Strong Authentication" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename targetResources{}.type as type diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 62c94fce3a..5b50c35122 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -11,14 +11,14 @@ description: 'The following analytic identifies one source Ip failing to authent Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.' -search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false +search: ' `azuread` body.category= SignInLogs body.properties.status.errorCode=50126 body.properties.authenticationDetails{}.succeeded= false | rename body.properties.* as * | bucket span=5m _time | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs. + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index c60d8b286d..6759e7ce17 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -18,7 +18,7 @@ description: 'The following analytic identifies one source Ip failing to authent While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.' -search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false +search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50126 body.properties.authenticationDetails{}.succeeded= false | rename body.properties.* as * | bucket span=5m _time | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress From cf08498d1b97d07872273dabf458dca1dcd54772 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 3 Oct 2022 12:23:27 -0700 Subject: [PATCH 09/10] update to spl --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 4 ++-- .../aws_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 14dc186d33..b10a29228c 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -6,8 +6,8 @@ author: Bhavin Patel type: Anomaly datamodel: - Endpoint -description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives: No known false postives for this detection. Please review this alert references: diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 46c7d959e6..a43bc7e2b3 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' From 6855e7aea0626ff5453c4aeb04ea42f0e7fefce4 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 3 Oct 2022 13:37:28 -0700 Subject: [PATCH 10/10] Update aws_multiple_users_failing_to_authenticate_from_ip.yml --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index b10a29228c..37311ef681 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -1,7 +1,7 @@ name: AWS Multiple Users Failing To Authenticate From Ip id: 71e1fb89-dd5f-4691-8523-575420de4630 version: 1 -date: '2022-09-26' +date: '2022-09-27' author: Bhavin Patel type: Anomaly datamodel: @@ -58,4 +58,4 @@ tags: - eventName - src_ip risk_score: 54 - security_domain: threat \ No newline at end of file + security_domain: threat