admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Recreated Issue 2019

Browse Source
This commit is contained in:
P4T12ICK
2022-04-01 15:36:25 +02:00
parent e1cb9ef11a
commit a2bc62ddc6
851 changed files with 50058 additions and 10104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md
+61 -10
View File
@@ -23,21 +23,77 @@ tags:
This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. In this instance, an attacker may upload malicious code/binary to a lambda function which will be executed automatically when the funnction is triggered.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2022-02-24
- **Author**: Bhavin Patel, Splunk
- **ID**: 211b80d3-6340-4345-11ad-212bf3d0d111
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.DS
* PR.AC
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -50,7 +106,7 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_lambda_updatefunctioncode_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_lambda_updatefunctioncode_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,9 +125,6 @@ While this search has no known false positives, it is possible that an AWS admin
* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -81,8 +134,6 @@ While this search has no known false positives, it is possible that an AWS admin
| 63.0 | 70 | 90 | User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$ |
#### Reference
* [http://detectioninthe.cloud/execution/modify_lambda_function_code/](http://detectioninthe.cloud/execution/modify_lambda_function_code/)
@@ -91,7 +142,7 @@ While this search has no known false positives, it is possible that an AWS admin
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)