admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

file name updates, initial migration to spec 3. dm2_yml files are legacy for reference and will be removed before merging

Browse Source
This commit is contained in:
Rico Valdez
2020-05-28 14:36:36 -06:00
parent 04f6e035bf
commit ac3003c8c9
13 changed files with 191 additions and 494 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/previously_seen_aws_cross_account_activity___dm.yml
+27 -47
View File
@@ -1,52 +1,32 @@
baseline:
splunk:
schedule:
cron_schedule: ''
earliest_time: -30d@d
latest_time: -10m@m
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from
datamodel=Authentication where Authentication.signature=AssumeRole by
Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role
| rex field=Authentication.user_role "arn:aws:sts:*:(?<dest_account>.*):" | where
'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
requestingAccountId dest_account as requestedAccountId | table requestingAccountId
requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity
creation_date: '2020-05-04'
data_metadata:
data_source:
- AWS CloudTrail logs
data_model
- Authentication
providing_technologies:
- AWS
description: This search looks for **AssumeRole** events where the requesting account
name: Previously Seen AWS Cross Account Activity - DM
id: 0de7ce99-ab0a-41fe-9624-345df83f08cc
version: 1
date: '2020-05-28'
description: This datamodel search looks for **AssumeRole** events where the requesting account
differs from the requested account, then writes these relationships to a lookup
file.
eli5: In this support search, we look for **AssumeRole** events where the requesting
account is different from the requested account. The first and last times these
events are seen are written to a lookup file.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
inputs. You must also be using CIM version x.x.x, which contains updates to the Authentication
data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
a lookup file created by this support search.
id: 0de7ce99-ab0a-41fe-9624-345df83f08cc
known_false_positives: ''
maintainers:
- company: Splunk
email: davidd@splunk.com
name: David Dorsey
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
modification_date: '2020-05-04'
name: Previously Seen AWS Cross Account Activity - DM
original_authors:
- company: Splunk
email: davidd@splunk.com
name: David Dorsey
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
spec_version: 2
type: splunk
version: '1.0'
author: Rico Valdezy, Splunk
search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
| spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
| where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime
latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup
previously_seen_aws_cross_account_activity | stats count'
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from
datamodel=Authentication where Authentication.signature=AssumeRole by
Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role
| rex field=Authentication.user_role "arn:aws:sts:*:(?<dest_account>.*):" | where
'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
requestingAccountId dest_account as requestedAccountId | table requestingAccountId
requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity'
tags:
analytics_story:
- AWS Cross Account Activity - DM
detections:
- AWS Cross Account Activity From Previously Unseen Account - DM
baselines/previously_seen_users_in_cloudtrail___dm.yml
+25 -49
View File
@@ -1,56 +1,32 @@
baseline:
splunk:
schedule:
cron_schedule: 0 0 1 * *
earliest_time: -30d@d
latest_time: -10m@m
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | rename Authentication.user as user Authentication.src as src
| table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins.csv
| stats count
creation_date: '2020-04-28'
data_metadata:
data_source:
- AWS CloudTrail logs
data_model:
- Authentication
providing_technologies:
- AWS
name: Previously seen users in CloudTrail - DM
id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
version: 1
date: '2020-05-28'
description: This search looks for CloudTrail events where a user logs into the console,
then creates a baseline of the latest and earliest times, City, Region, and Country
we have encountered this user in our dataset, grouped by ARN, within the last 30
we have encountered this user in our dataset, grouped by username, within the last 30
days.
eli5: In this support search, we look for console login events by a particular user
and create an initial baseline cache for the previous 30 days, including the earliest
and latest times, City, Region, and Country a particular user ARN is seen in our
dataset, grouped by the ARN value. In cases where City and Region cannot be determined,
the source IP address is substituted for these values.
entities:
- user
- src
update with versions in how-to-implement
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`,
which is a lookup file created as a result of running this support search.
id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
known_false_positives: n/a
maintainers:
- company: Splunk
email: bpatel@splunk.com
name: Bhavin Patel
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
modification_date: '2020-04-28'
name: Previously seen users in CloudTrail
original_authors:
- company: Splunk
email: bpatel@splunk.com
name: Bhavin Patel
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
spec_version: 2
type: splunk
version: '1.0'
author: Rico Valdez, Splunk
search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region
Country | outputlookup previously_seen_users_console_logins.csv | stats count'
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | rename Authentication.user as user Authentication.src as src
| table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins.csv
| stats count
tags:
analytics_story:
- Suspicious AWS Login Activities - DM
detections:
- Detect AWS Console Login by User from New Country
- Detect AWS Console Login by User from New Region
- Detect AWS Console Login by User from New City
- Detect new user AWS Console Login - DM
baselines/update_previously_seen_users_in_cloudtrail___dm.yml
+28 -46
View File
@@ -1,52 +1,34 @@
tag
baseline:
splunk:
schedule:
cron_schedule: 0 0 1 * *
earliest_time: -60m@m
latest_time: m@m
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from
datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user
Authenticaiton.src | iplocation Authentication.src | rename Authentication.user as user
Authentciation.src as src | table user src City Region Country firstTime lastTime
| inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as
firstTime max(lastTime) as lastTime by user src City Region Country
| outputlookup previously_seen_users_console_logins.csv
creation_date: '2020-04-28'
data_metadata:
data_source:
- AWS CloudTrail logs
data_model:
- Authentication
providing_technologies:
- AWS
name: Update previously seen users in CloudTrail - DM
id: 66ff71c2-7e01-47dd-a041-906688c9d322
version: 1
date: '2020-05-28'
description: This search looks for CloudTrail events where a user logs into the console,
then updates the baseline of the latest and earliest times, City, Region, and Country
we have encountered this user in our dataset, grouped by ARN, within the last hour.
eli5: In this support search, we look for console login events by a particular user
to update the baseline cache of users/arns making the accesses, including the earliest
and latest times, City, Region, and Country a particular user ARN is seen in our
dataset, grouped by the ARN value. In cases where City and Region cannot be determined,
the source IP address is substituted for these values.
entities:
- user
- src
we have encountered this user in our dataset, grouped by user, within the last hour.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`,
which is a lookup file created as a result of running this support search.
id: 66ff71c2-7e01-47dd-a041-906688c9d322
known_false_positives: n/a
maintainers:
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
modification_date: '2018-04-30'
name: Update previously seen users in CloudTrail
original_authors:
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
spec_version: 2
type: splunk
version: '1.0'
author: Rico Valdez, Splunk
search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region
Country | inputlookup append=t previously_seen_users_console_logins.csv | stats
min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country
| outputlookup previously_seen_users_console_logins.csv'
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from
datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user
Authenticaiton.src | iplocation Authentication.src | rename Authentication.user as user
Authentciation.src as src | table user src City Region Country firstTime lastTime
| inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as
firstTime max(lastTime) as lastTime by user src City Region Country
| outputlookup previously_seen_users_console_logins.csv'
tags:
analytics_story:
- Suspicious AWS Login Activities - DM
detections:
- Detect AWS Console Login by User from New Country
- Detect AWS Console Login by User from New Region
- Detect AWS Console Login by User from New City
- Detect new user AWS Console Login - DM
detections/aws_cross_account_activity_from_new_account_dm.yml
-127
View File
@@ -1,127 +0,0 @@
tag
asset_type: AWS Instance
baselines:
- id: 0de7ce99-ab0a-41fe-9624-345df83f08cc
name: Previously Seen AWS Cross Account Activity - DM
type: splunk
confidence: medium
creation_date: '2020-05-04'
data_metadata:
data_source:
- AWS CloudTrail logs
data_model
- Authentication
providing_technologies:
- AWS
description: This search looks for AssumeRole events where an IAM role in a different
account is requested for the first time.
detect:
splunk:
correlation_rule:
notable:
nes_fields: requestingAccountId, requestedAccountId, src_user
rule_description: Access to $dest_user$ was requested for the first time by
$src_user$
rule_title: AWS Account $requestedAccountId$ access by $requestingAccountId$
risk:
risk_object: src_user
risk_object_type:
- user
risk_score: 20
schedule:
cron_schedule: 5 * * * *
earliest_time: -70m@m
latest_time: -10m@m
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication_test
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
Authentication.user_role | rex field=Authentication.user_role "arn:aws:sts:*:(?<dest_account>.*):"
| where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity
requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest
| eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | multireport [| table requestingAccountId,
requestedAccountId, firstTime, lastTime | outputlookup rvtest.csv | where fact=fiction][|
where firstTime >= relative_time(now(), "-70m@m")] | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_new_account_filter`
| rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId,
requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime
suppress:
suppress_fields: requestingAccountId, requestedAccountId
suppress_period: 14400s
eli5: 'This search\
1. Retrieves the **AssumeRole** event\
1. Verifies that the log entry contains a value for the account ID of the requesting
account\
1. Ensures that the requesting account ID does not match the account ID of the requested
account\
1. Pulls in the previously seen requesting and requested account IDs\
1. Ensures that firstTime contains the earliest time the activity is seen.\
1. Splits up and executes multiple search paths at the same.\
1. The first path determines the **firstTime** and **lastTime** entries for the
cache file\
1. Outputs the data to the cache file.\
1. Creates a conditional statement that is always false (both because we don''t
want these values to exit the search pipeline and because we think we''re clever).The
second pipeline adds the **firstTime** and **lastTime** entries to search results.
Next, it filters out any account pairs that haven''t been seen for the first time
within the last hour. The `isnotnull(_time)` will remove the entries from the cache
file.\
The search finishes by gathering the data that it will display to the user.'
entities:
- src_user
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the `Previously Seen AWS Cross Account Activity` support search only
once to create the baseline of previously seen cross account activity. Thanks to
Pablo Vega at Recurly for suggesting improvements to the search.
id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
investigations:
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
name: Get Notable History
type: splunk
- id: b0d2e6a8-75fa-4b1b-9486-3d32acadf891
name: AWS Investigate User Activities By Source User
type: splunk
known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
It's suspicious when an account requests privileges of an account it hasn't before.
You should validate with the account owner that this is a legitimate request.
maintainers:
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- Credential Access
nist:
- PR.AC
- PR.DS
- DE.AE
modification_date: '2020-05-04'
name: AWS Cross Account Activity From Previously Unseen Account - DM
original_authors:
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
- company: Splunk
email: davidd@splunk.com
name: David Dorsey
references: []
security_domain: network
spec_version: 2
type: splunk
version: '1.0'
detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml
+60
View File
@@ -0,0 +1,60 @@
name: AWS Cross Account Activity From Previously Unseen Account - DM
id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
version: 1
date: '2020-05-28'
description: This search looks for AssumeRole events where an IAM role in a different
account is requested for the first time.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the `Previously Seen AWS Cross Account Activity` support search only
once to create the baseline of previously seen cross account activity. Thanks to
Pablo Vega at Recurly for suggesting improvements to the search.
type: ESCU
references: []
author: Rico Valdez, Splunk
search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
| spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
| where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity
| multireport [| stats min(eval(coalesce(firstTime, _time)))
as firstTime max(eval(coalesce(lastTime, _time)))
as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity
| where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime,
max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime
>= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId
path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN
| stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime)
as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user,
values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId,
requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId,
dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`'
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication_test
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
Authentication.user_role | rex field=Authentication.user_role "arn:aws:sts:*:(?<dest_account>.*):"
| where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity
requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest
| eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | multireport [| table requestingAccountId,
requestedAccountId, firstTime, lastTime | outputlookup rvtest.csv | where fact=fiction][|
where firstTime >= relative_time(now(), "-70m@m")] | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_new_account_filter`
| rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId,
requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime
known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
It's suspicious when an account requests privileges of an account it hasn't before.
You should validate with the account owner that this is a legitimate request.
tags:
analytics_story:
- AWS Cross Account Activity - DM
kill_chain_phases:
- Actions on Objectives
cis20:
- CIS 16
nist:
- PR.AC
- PR.DS
- DE.AE
security_domain: network
asset_type: AWS Instance
detections/detect_aws_console_login_by_user_from_new_city.yml
+1
View File
@@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi
tags:
analytics_story:
- Suspicious AWS Login Activities
- new story
kill_chain_phases:
- Actions on Objectives
cis20:
detections/detect_aws_console_login_by_user_from_new_city___dm.yml
-41
View File
@@ -1,41 +0,0 @@
name: Detect AWS Console Login by User from New City
id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
version: 1
date: '2018-04-30'
description: This search looks for CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
type: ESCU
author: Jason Brewer, Splunk
search: '| inputlookup previously_seen_users_console_logins.csv | stats min(firstTime)
as firstTime max(lastTime) as lastTime by user City | join user type=outer [| inputlookup
previously_seen_users_console_logins.csv | stats min(firstTime) AS earliestseen
by user | fields earliestseen user] | eval userStatus=if(firstTime >= relative_time(now(),
"@d"), "New City","Previously Seen City") | eval UserData=if(earliestseen >= relative_time(now(),
"@d") OR isnull(earliestseen), "New User","Old User") | where userStatus="New City"
AND UserData="Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`security_content_ctime(earliestseen)` | table user City userStatus firstTime lastTime
earliestseen | `detect_aws_console_login_by_user_from_new_city_filter`'
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
tags:
analytics_story:
- Suspicious AWS Login Activities
kill_chain_phases:
- Actions on Objectives
cis20:
- CIS 16
nist:
- DE.DP
- DE.AE
security_domain: network
asset_type: AWS Instance
detections/detect_aws_console_login_by_user_from_new_country.yml
+1
View File
@@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi
tags:
analytics_story:
- Suspicious AWS Login Activities
- add new story
kill_chain_phases:
- Actions on Objectives
cis20:
detections/detect_aws_console_login_by_user_from_new_country___dm.yml
-41
View File
@@ -1,41 +0,0 @@
name: Detect AWS Console Login by User from New Country
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
version: 1
date: '2018-04-30'
description: This search looks for CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
type: ESCU
author: Jason Brewer, Splunk
search: '| inputlookup previously_seen_users_console_logins.csv | stats min(firstTime)
as firstTime max(lastTime) as lastTime by user Country | join user type=outer [|
inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) AS earliestseen
by user | fields earliestseen user] | eval userStatus=if(firstTime >= relative_time(now(),
"@d"), "New Country","Previously Seen Country") | eval UserData=if(earliestseen
>= relative_time(now(), "@d") OR isnull(earliestseen), "New User","Old User") |
where userStatus="New Country" AND UserData="Old User" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`security_content_ctime(earliestseen)` | table
user Country userStatus firstTime lastTime earliestseen | `detect_aws_console_login_by_user_from_new_country_filter`'
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
tags:
analytics_story:
- Suspicious AWS Login Activities
kill_chain_phases:
- Actions on Objectives
cis20:
- CIS 16
nist:
- DE.DP
- DE.AE
security_domain: network
asset_type: AWS Instance
detections/detect_aws_console_login_by_user_from_new_region.yml
+1
View File
@@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi
tags:
analytics_story:
- Suspicious AWS Login Activities
- new story
kill_chain_phases:
- Actions on Objectives
cis20:
detections/detect_aws_console_login_by_user_from_new_region___dm.yml
-41
View File
@@ -1,41 +0,0 @@
name: Detect AWS Console Login by User from New Region
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
version: 1
date: '2018-04-30'
description: This search looks for CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
type: ESCU
author: Jason Brewer, Splunk
search: '| inputlookup previously_seen_users_console_logins.csv | stats min(firstTime)
as firstTime max(lastTime) as lastTime by user Region | join user type=outer [|
inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) AS earliestseen
by user | fields earliestseen user] | eval userStatus=if(firstTime >= relative_time(now(),
"@d"), "New Region","Previously Seen Region") | eval UserData=if(earliestseen >=
relative_time(now(), "@d") OR isnull(earliestseen), "New User","Old User") | where
userStatus="New Region" AND UserData="Old User" | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `security_content_ctime(earliestseen)` | table
user Region userStatus firstTime lastTime earliestseen | `detect_aws_console_login_by_user_from_new_region_filter`'
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
tags:
analytics_story:
- Suspicious AWS Login Activities
kill_chain_phases:
- Actions on Objectives
cis20:
- CIS 16
nist:
- DE.DP
- DE.AE
security_domain: network
asset_type: AWS Instance
detections/detect_new_user_aws_console_login___dm.yml
+48
View File
@@ -0,0 +1,48 @@
name: Detect new user AWS Console Login - DM
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
version: 1
date: '2020-05-28'
description: This search looks for CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
type: ESCU
author: Rico Valdez, Splunk
search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | stats
earliest(_time) as firstTime latest(_time) as lastTime by user | inputlookup append=t
previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime max(lastTime)
as lastTime by user | eval userStatus=if(firstTime >= relative_time(now(), "-70m@m"),
"First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`'
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from
datamodel=Authentication where Authentication.signature=ConsoleLogin by
Authentication.user | rename Authentication.user as user | inputlookup append=t
previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime
max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=
relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User")
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_new_user_aws_console_login_filter`
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
tags:
analytics_story:
- Suspicious AWS Login Activities - DM
kill_chain_phases:
- Actions on Objectives
cis20:
- CIS 16
nist:
- DE.DP
- DE.AE
security_domain: network
asset_type: AWS Instance
detections/detect_new_user_aws_console_login_dm.yml
-102
View File
@@ -1,102 +0,0 @@
asset_type: AWS Instance
baselines:
- id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
name: Previously seen users in CloudTrail
type: splunk
- id: 66ff71c2-7e01-47dd-a041-906688c9d322
name: Update previously seen users in CloudTrail
type: splunk
confidence: medium
creation_date: '2020-04-28'
data_metadata:
data_source:
- AWS CloudTrail logs
data_model:
- Authentication
providing_technologies:
- AWS
description: This search looks for CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
detect:
splunk:
correlation_rule:
notable:
nes_fields: user
rule_description: A new user has logged into the AWS console
rule_title: AWS Console Login by New User
risk:
risk_object: user
risk_object_type:
- user
risk_score: 30
schedule:
cron_schedule: 5 * * * *
earliest_time: -70m@m
latest_time: -10m@m
search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from
datamodel=Authentication where Authentication.signature=ConsoleLogin by
Authentication.user | rename Authentication.user as user | inputlookup append=t
previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime
max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=
relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User")
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_new_user_aws_console_login_filter`
suppress:
suppress_fields: user
suppress_period: 86400s
eli5: In this search, we query CloudTrail logs to look for events that indicate that
a user has attempted to log in to the AWS console and group the events using ARN
value. Using the `previously_seen_users_console_logins.csv` lookup file created
using the support search, we compare the ARN to all the previously seen users logging
into the AWS console. The `eval` and `if` functions determine whether the earliest
time we see this user ARN was seen within the last hour. The alert will be fired
only when a user is seen for first time in the last hour.
entities:
- user
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
id: 1212b18e-583e-4fe8-87c6-e27b3171f99f
investigations:
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
name: AWS Investigate User Activities By ARN
type: splunk
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
maintainers:
- company: Splunk
email: bpatel@splunk.com
name: Bhavin Patel
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- Credential Access
nist:
- DE.DP
- DE.AE
modification_date: '2018-04-30'
name: Detect New User AWS Console Login
original_authors:
- company: Splunk
email: bpatel@splunk.com
name: Bhavin Patel
- company: Splunk
email: rvaldez@splunk.com
name: Rico Valdez
security_domain: network
spec_version: 2
type: splunk
version: '1.0'