From ac3003c8c98f67b7498d90ff48e58b74ae3fc8de Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Thu, 28 May 2020 14:36:36 -0600 Subject: [PATCH] file name updates, initial migration to spec 3. dm2_yml files are legacy for reference and will be removed before merging --- ...y_seen_aws_cross_account_activity___dm.yml | 74 ++++------ ...eviously_seen_users_in_cloudtrail___dm.yml | 74 ++++------ ...eviously_seen_users_in_cloudtrail___dm.yml | 74 ++++------ ...s_account_activity_from_new_account_dm.yml | 127 ------------------ ...ty_from_previously_unseen_account___dm.yml | 60 +++++++++ ...ws_console_login_by_user_from_new_city.yml | 1 + ...nsole_login_by_user_from_new_city___dm.yml | 41 ------ ...console_login_by_user_from_new_country.yml | 1 + ...le_login_by_user_from_new_country___dm.yml | 41 ------ ..._console_login_by_user_from_new_region.yml | 1 + ...ole_login_by_user_from_new_region___dm.yml | 41 ------ ...detect_new_user_aws_console_login___dm.yml | 48 +++++++ .../detect_new_user_aws_console_login_dm.yml | 102 -------------- 13 files changed, 191 insertions(+), 494 deletions(-) delete mode 100644 detections/aws_cross_account_activity_from_new_account_dm.yml create mode 100644 detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml delete mode 100644 detections/detect_aws_console_login_by_user_from_new_city___dm.yml delete mode 100644 detections/detect_aws_console_login_by_user_from_new_country___dm.yml delete mode 100644 detections/detect_aws_console_login_by_user_from_new_region___dm.yml create mode 100644 detections/detect_new_user_aws_console_login___dm.yml delete mode 100644 detections/detect_new_user_aws_console_login_dm.yml diff --git a/baselines/previously_seen_aws_cross_account_activity___dm.yml b/baselines/previously_seen_aws_cross_account_activity___dm.yml index 248ee7803b..ca50547dbb 100644 --- a/baselines/previously_seen_aws_cross_account_activity___dm.yml +++ b/baselines/previously_seen_aws_cross_account_activity___dm.yml @@ -1,52 +1,32 @@ -baseline: - splunk: - schedule: - cron_schedule: '' - earliest_time: -30d@d - latest_time: -10m@m - search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from - datamodel=Authentication where Authentication.signature=AssumeRole by - Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role - | rex field=Authentication.user_role "arn:aws:sts:*:(?.*):" | where - 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as - requestingAccountId dest_account as requestedAccountId | table requestingAccountId - requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity -creation_date: '2020-05-04' -data_metadata: - data_source: - - AWS CloudTrail logs - data_model - - Authentication - providing_technologies: - - AWS -description: This search looks for **AssumeRole** events where the requesting account +name: Previously Seen AWS Cross Account Activity - DM +id: 0de7ce99-ab0a-41fe-9624-345df83f08cc +version: 1 +date: '2020-05-28' +description: This datamodel search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -eli5: In this support search, we look for **AssumeRole** events where the requesting - account is different from the requested account. The first and last times these - events are seen are written to a lookup file. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, + inputs. You must also be using CIM version x.x.x, which contains updates to the Authentication + data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -id: 0de7ce99-ab0a-41fe-9624-345df83f08cc -known_false_positives: '' -maintainers: - - company: Splunk - email: davidd@splunk.com - name: David Dorsey - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -modification_date: '2020-05-04' -name: Previously Seen AWS Cross Account Activity - DM -original_authors: - - company: Splunk - email: davidd@splunk.com - name: David Dorsey - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -spec_version: 2 -type: splunk -version: '1.0' +author: Rico Valdezy, Splunk +search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId + | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* + | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime + latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup + previously_seen_aws_cross_account_activity | stats count' + + +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from + datamodel=Authentication where Authentication.signature=AssumeRole by + Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role + | rex field=Authentication.user_role "arn:aws:sts:*:(?.*):" | where + 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as + requestingAccountId dest_account as requestedAccountId | table requestingAccountId + requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity' +tags: + analytics_story: + - AWS Cross Account Activity - DM + detections: + - AWS Cross Account Activity From Previously Unseen Account - DM diff --git a/baselines/previously_seen_users_in_cloudtrail___dm.yml b/baselines/previously_seen_users_in_cloudtrail___dm.yml index 0a17eb01bc..d93488918f 100644 --- a/baselines/previously_seen_users_in_cloudtrail___dm.yml +++ b/baselines/previously_seen_users_in_cloudtrail___dm.yml @@ -1,56 +1,32 @@ -baseline: - splunk: - schedule: - cron_schedule: 0 0 1 * * - earliest_time: -30d@d - latest_time: -10m@m - search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src - | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src - | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins.csv - | stats count -creation_date: '2020-04-28' -data_metadata: - data_source: - - AWS CloudTrail logs - data_model: - - Authentication - providing_technologies: - - AWS +name: Previously seen users in CloudTrail - DM +id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 +version: 1 +date: '2020-05-28' description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country - we have encountered this user in our dataset, grouped by ARN, within the last 30 + we have encountered this user in our dataset, grouped by username, within the last 30 days. -eli5: In this support search, we look for console login events by a particular user - and create an initial baseline cache for the previous 30 days, including the earliest - and latest times, City, Region, and Country a particular user ARN is seen in our - dataset, grouped by the ARN value. In cases where City and Region cannot be determined, - the source IP address is substituted for these values. -entities: - - user - - src +update with versions in how-to-implement how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`, which is a lookup file created as a result of running this support search. -id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 -known_false_positives: n/a -maintainers: - - company: Splunk - email: bpatel@splunk.com - name: Bhavin Patel - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -modification_date: '2020-04-28' -name: Previously seen users in CloudTrail -original_authors: - - company: Splunk - email: bpatel@splunk.com - name: Bhavin Patel - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -spec_version: 2 -type: splunk -version: '1.0' +author: Rico Valdez, Splunk +search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation + src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | + stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region + Country | outputlookup previously_seen_users_console_logins.csv | stats count' + +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication + where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src + | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src + | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins.csv + | stats count +tags: + analytics_story: + - Suspicious AWS Login Activities - DM + detections: + - Detect AWS Console Login by User from New Country + - Detect AWS Console Login by User from New Region + - Detect AWS Console Login by User from New City + - Detect new user AWS Console Login - DM diff --git a/baselines/update_previously_seen_users_in_cloudtrail___dm.yml b/baselines/update_previously_seen_users_in_cloudtrail___dm.yml index 58a0c4bc67..c1e0e55bc3 100644 --- a/baselines/update_previously_seen_users_in_cloudtrail___dm.yml +++ b/baselines/update_previously_seen_users_in_cloudtrail___dm.yml @@ -1,52 +1,34 @@ -tag -baseline: - splunk: - schedule: - cron_schedule: 0 0 1 * * - earliest_time: -60m@m - latest_time: m@m - search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from - datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user - Authenticaiton.src | iplocation Authentication.src | rename Authentication.user as user - Authentciation.src as src | table user src City Region Country firstTime lastTime - | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as - firstTime max(lastTime) as lastTime by user src City Region Country - | outputlookup previously_seen_users_console_logins.csv -creation_date: '2020-04-28' -data_metadata: - data_source: - - AWS CloudTrail logs - data_model: - - Authentication - providing_technologies: - - AWS +name: Update previously seen users in CloudTrail - DM +id: 66ff71c2-7e01-47dd-a041-906688c9d322 +version: 1 +date: '2020-05-28' description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country - we have encountered this user in our dataset, grouped by ARN, within the last hour. -eli5: In this support search, we look for console login events by a particular user - to update the baseline cache of users/arns making the accesses, including the earliest - and latest times, City, Region, and Country a particular user ARN is seen in our - dataset, grouped by the ARN value. In cases where City and Region cannot be determined, - the source IP address is substituted for these values. -entities: - - user - - src + we have encountered this user in our dataset, grouped by user, within the last hour. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`, which is a lookup file created as a result of running this support search. -id: 66ff71c2-7e01-47dd-a041-906688c9d322 -known_false_positives: n/a -maintainers: - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -modification_date: '2018-04-30' -name: Update previously seen users in CloudTrail -original_authors: - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -spec_version: 2 -type: splunk -version: '1.0' +author: Rico Valdez, Splunk +search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation + src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | + stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region + Country | inputlookup append=t previously_seen_users_console_logins.csv | stats + min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country + | outputlookup previously_seen_users_console_logins.csv' + +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from + datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user + Authenticaiton.src | iplocation Authentication.src | rename Authentication.user as user + Authentciation.src as src | table user src City Region Country firstTime lastTime + | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as + firstTime max(lastTime) as lastTime by user src City Region Country + | outputlookup previously_seen_users_console_logins.csv' +tags: + analytics_story: + - Suspicious AWS Login Activities - DM + detections: + - Detect AWS Console Login by User from New Country + - Detect AWS Console Login by User from New Region + - Detect AWS Console Login by User from New City + - Detect new user AWS Console Login - DM diff --git a/detections/aws_cross_account_activity_from_new_account_dm.yml b/detections/aws_cross_account_activity_from_new_account_dm.yml deleted file mode 100644 index 8a83fad80d..0000000000 --- a/detections/aws_cross_account_activity_from_new_account_dm.yml +++ /dev/null @@ -1,127 +0,0 @@ -tag -asset_type: AWS Instance -baselines: - - id: 0de7ce99-ab0a-41fe-9624-345df83f08cc - name: Previously Seen AWS Cross Account Activity - DM - type: splunk -confidence: medium -creation_date: '2020-05-04' -data_metadata: - data_source: - - AWS CloudTrail logs - data_model - - Authentication - providing_technologies: - - AWS -description: This search looks for AssumeRole events where an IAM role in a different - account is requested for the first time. -detect: - splunk: - correlation_rule: - notable: - nes_fields: requestingAccountId, requestedAccountId, src_user - rule_description: Access to $dest_user$ was requested for the first time by - $src_user$ - rule_title: AWS Account $requestedAccountId$ access by $requestingAccountId$ - risk: - risk_object: src_user - risk_object_type: - - user - risk_score: 20 - schedule: - cron_schedule: 5 * * * * - earliest_time: -70m@m - latest_time: -10m@m - search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication_test - where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src - Authentication.user_role | rex field=Authentication.user_role "arn:aws:sts:*:(?.*):" - | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as - requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity - requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest - | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | multireport [| table requestingAccountId, - requestedAccountId, firstTime, lastTime | outputlookup rvtest.csv | where fact=fiction][| - where firstTime >= relative_time(now(), "-70m@m")] | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_new_account_filter` - | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId, - requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime - - suppress: - suppress_fields: requestingAccountId, requestedAccountId - suppress_period: 14400s - -eli5: 'This search\ - - 1. Retrieves the **AssumeRole** event\ - - 1. Verifies that the log entry contains a value for the account ID of the requesting - account\ - - 1. Ensures that the requesting account ID does not match the account ID of the requested - account\ - - 1. Pulls in the previously seen requesting and requested account IDs\ - - 1. Ensures that firstTime contains the earliest time the activity is seen.\ - - 1. Splits up and executes multiple search paths at the same.\ - - 1. The first path determines the **firstTime** and **lastTime** entries for the - cache file\ - - 1. Outputs the data to the cache file.\ - - 1. Creates a conditional statement that is always false (both because we don''t - want these values to exit the search pipeline and because we think we''re clever).The - second pipeline adds the **firstTime** and **lastTime** entries to search results. - Next, it filters out any account pairs that haven''t been seen for the first time - within the last hour. The `isnotnull(_time)` will remove the entries from the cache - file.\ - - The search finishes by gathering the data that it will display to the user.' -entities: - - src_user -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the `Previously Seen AWS Cross Account Activity` support search only - once to create the baseline of previously seen cross account activity. Thanks to - Pablo Vega at Recurly for suggesting improvements to the search. -id: 21193641-cb96-4a2c-a707-d9b9a7f7792b -investigations: - - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 - name: Get Notable History - type: splunk - - id: b0d2e6a8-75fa-4b1b-9486-3d32acadf891 - name: AWS Investigate User Activities By Source User - type: splunk -known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior. - It's suspicious when an account requests privileges of an account it hasn't before. - You should validate with the account owner that this is a legitimate request. -maintainers: - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - Credential Access - nist: - - PR.AC - - PR.DS - - DE.AE -modification_date: '2020-05-04' -name: AWS Cross Account Activity From Previously Unseen Account - DM -original_authors: - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez - - company: Splunk - email: davidd@splunk.com - name: David Dorsey -references: [] -security_domain: network -spec_version: 2 -type: splunk -version: '1.0' diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml new file mode 100644 index 0000000000..bfc12b6bb9 --- /dev/null +++ b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml @@ -0,0 +1,60 @@ +name: AWS Cross Account Activity From Previously Unseen Account - DM +id: 21193641-cb96-4a2c-a707-d9b9a7f7792b +version: 1 +date: '2020-05-28' +description: This search looks for AssumeRole events where an IAM role in a different + account is requested for the first time. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. Run the `Previously Seen AWS Cross Account Activity` support search only + once to create the baseline of previously seen cross account activity. Thanks to + Pablo Vega at Recurly for suggesting improvements to the search. +type: ESCU +references: [] +author: Rico Valdez, Splunk +search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId + | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* + | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity + | multireport [| stats min(eval(coalesce(firstTime, _time))) + as firstTime max(eval(coalesce(lastTime, _time))) + as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity + | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime, + max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime + >= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId + path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN + | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime) + as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user, + values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId, + requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId, + dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`' + + +search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication_test + where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src + Authentication.user_role | rex field=Authentication.user_role "arn:aws:sts:*:(?.*):" + | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as + requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity + requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest + | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | multireport [| table requestingAccountId, + requestedAccountId, firstTime, lastTime | outputlookup rvtest.csv | where fact=fiction][| + where firstTime >= relative_time(now(), "-70m@m")] | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_new_account_filter` + | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId, + requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime + +known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior. + It's suspicious when an account requests privileges of an account it hasn't before. + You should validate with the account owner that this is a legitimate request. +tags: + analytics_story: + - AWS Cross Account Activity - DM + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 16 + nist: + - PR.AC + - PR.DS + - DE.AE + security_domain: network + asset_type: AWS Instance diff --git a/detections/detect_aws_console_login_by_user_from_new_city.yml b/detections/detect_aws_console_login_by_user_from_new_city.yml index a3797cc46e..c621459148 100644 --- a/detections/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/detect_aws_console_login_by_user_from_new_city.yml @@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi tags: analytics_story: - Suspicious AWS Login Activities + - new story kill_chain_phases: - Actions on Objectives cis20: diff --git a/detections/detect_aws_console_login_by_user_from_new_city___dm.yml b/detections/detect_aws_console_login_by_user_from_new_city___dm.yml deleted file mode 100644 index a3797cc46e..0000000000 --- a/detections/detect_aws_console_login_by_user_from_new_city___dm.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Detect AWS Console Login by User from New City -id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a -version: 1 -date: '2018-04-30' -description: This search looks for CloudTrail events wherein a console login event - by a user was recorded within the last hour, then compares the event to a lookup - file of previously seen users (by ARN values) who have logged into the console. - The alert is fired if the user has logged into the console for the first time within - the last hour -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the "Previously seen users in CloudTrail" support search only once to - create a baseline of previously seen IAM users within the last 30 days. Run "Update - previously seen users in CloudTrail" hourly (or more frequently depending on how - often you run the detection searches) to refresh the baselines. -type: ESCU -author: Jason Brewer, Splunk -search: '| inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) - as firstTime max(lastTime) as lastTime by user City | join user type=outer [| inputlookup - previously_seen_users_console_logins.csv | stats min(firstTime) AS earliestseen - by user | fields earliestseen user] | eval userStatus=if(firstTime >= relative_time(now(), - "@d"), "New City","Previously Seen City") | eval UserData=if(earliestseen >= relative_time(now(), - "@d") OR isnull(earliestseen), "New User","Old User") | where userStatus="New City" - AND UserData="Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `security_content_ctime(earliestseen)` | table user City userStatus firstTime lastTime - earliestseen | `detect_aws_console_login_by_user_from_new_city_filter`' -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -tags: - analytics_story: - - Suspicious AWS Login Activities - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 16 - nist: - - DE.DP - - DE.AE - security_domain: network - asset_type: AWS Instance diff --git a/detections/detect_aws_console_login_by_user_from_new_country.yml b/detections/detect_aws_console_login_by_user_from_new_country.yml index 60fccc3b0a..12f6e7dc10 100644 --- a/detections/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/detect_aws_console_login_by_user_from_new_country.yml @@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi tags: analytics_story: - Suspicious AWS Login Activities + - add new story kill_chain_phases: - Actions on Objectives cis20: diff --git a/detections/detect_aws_console_login_by_user_from_new_country___dm.yml b/detections/detect_aws_console_login_by_user_from_new_country___dm.yml deleted file mode 100644 index 60fccc3b0a..0000000000 --- a/detections/detect_aws_console_login_by_user_from_new_country___dm.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Detect AWS Console Login by User from New Country -id: 67bd3def-c41c-4bf6-837b-ae196b4257c6 -version: 1 -date: '2018-04-30' -description: This search looks for CloudTrail events wherein a console login event - by a user was recorded within the last hour, then compares the event to a lookup - file of previously seen users (by ARN values) who have logged into the console. - The alert is fired if the user has logged into the console for the first time within - the last hour -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the "Previously seen users in CloudTrail" support search only once to - create a baseline of previously seen IAM users within the last 30 days. Run "Update - previously seen users in CloudTrail" hourly (or more frequently depending on how - often you run the detection searches) to refresh the baselines. -type: ESCU -author: Jason Brewer, Splunk -search: '| inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) - as firstTime max(lastTime) as lastTime by user Country | join user type=outer [| - inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) AS earliestseen - by user | fields earliestseen user] | eval userStatus=if(firstTime >= relative_time(now(), - "@d"), "New Country","Previously Seen Country") | eval UserData=if(earliestseen - >= relative_time(now(), "@d") OR isnull(earliestseen), "New User","Old User") | - where userStatus="New Country" AND UserData="Old User" | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`|`security_content_ctime(earliestseen)` | table - user Country userStatus firstTime lastTime earliestseen | `detect_aws_console_login_by_user_from_new_country_filter`' -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -tags: - analytics_story: - - Suspicious AWS Login Activities - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 16 - nist: - - DE.DP - - DE.AE - security_domain: network - asset_type: AWS Instance diff --git a/detections/detect_aws_console_login_by_user_from_new_region.yml b/detections/detect_aws_console_login_by_user_from_new_region.yml index 47ac42c4f2..2c0bf1406e 100644 --- a/detections/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/detect_aws_console_login_by_user_from_new_region.yml @@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi tags: analytics_story: - Suspicious AWS Login Activities + - new story kill_chain_phases: - Actions on Objectives cis20: diff --git a/detections/detect_aws_console_login_by_user_from_new_region___dm.yml b/detections/detect_aws_console_login_by_user_from_new_region___dm.yml deleted file mode 100644 index 47ac42c4f2..0000000000 --- a/detections/detect_aws_console_login_by_user_from_new_region___dm.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Detect AWS Console Login by User from New Region -id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 -version: 1 -date: '2018-04-30' -description: This search looks for CloudTrail events wherein a console login event - by a user was recorded within the last hour, then compares the event to a lookup - file of previously seen users (by ARN values) who have logged into the console. - The alert is fired if the user has logged into the console for the first time within - the last hour -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the "Previously seen users in CloudTrail" support search only once to - create a baseline of previously seen IAM users within the last 30 days. Run "Update - previously seen users in CloudTrail" hourly (or more frequently depending on how - often you run the detection searches) to refresh the baselines. -type: ESCU -author: Jason Brewer, Splunk -search: '| inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) - as firstTime max(lastTime) as lastTime by user Region | join user type=outer [| - inputlookup previously_seen_users_console_logins.csv | stats min(firstTime) AS earliestseen - by user | fields earliestseen user] | eval userStatus=if(firstTime >= relative_time(now(), - "@d"), "New Region","Previously Seen Region") | eval UserData=if(earliestseen >= - relative_time(now(), "@d") OR isnull(earliestseen), "New User","Old User") | where - userStatus="New Region" AND UserData="Old User" | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `security_content_ctime(earliestseen)` | table - user Region userStatus firstTime lastTime earliestseen | `detect_aws_console_login_by_user_from_new_region_filter`' -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -tags: - analytics_story: - - Suspicious AWS Login Activities - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 16 - nist: - - DE.DP - - DE.AE - security_domain: network - asset_type: AWS Instance diff --git a/detections/detect_new_user_aws_console_login___dm.yml b/detections/detect_new_user_aws_console_login___dm.yml new file mode 100644 index 0000000000..3aeac6788f --- /dev/null +++ b/detections/detect_new_user_aws_console_login___dm.yml @@ -0,0 +1,48 @@ +name: Detect new user AWS Console Login - DM +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 +version: 1 +date: '2020-05-28' +description: This search looks for CloudTrail events wherein a console login event + by a user was recorded within the last hour, then compares the event to a lookup + file of previously seen users (by ARN values) who have logged into the console. + The alert is fired if the user has logged into the console for the first time within + the last hour +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. Run the "Previously seen users in CloudTrail" support search only once to + create a baseline of previously seen IAM users within the last 30 days. Run "Update + previously seen users in CloudTrail" hourly (or more frequently depending on how + often you run the detection searches) to refresh the baselines. +type: ESCU +author: Rico Valdez, Splunk +search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | stats + earliest(_time) as firstTime latest(_time) as lastTime by user | inputlookup append=t + previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime max(lastTime) + as lastTime by user | eval userStatus=if(firstTime >= relative_time(now(), "-70m@m"), + "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| + where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`' + + +search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from + datamodel=Authentication where Authentication.signature=ConsoleLogin by + Authentication.user | rename Authentication.user as user | inputlookup append=t + previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime + max(lastTime) as lastTime by user | eval userStatus=if(firstTime >= + relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_new_user_aws_console_login_filter` +known_false_positives: When a legitimate new user logins for the first time, this + activity will be detected. Check how old the account is and verify that the user + activity is legitimate. +tags: + analytics_story: + - Suspicious AWS Login Activities - DM + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 16 + nist: + - DE.DP + - DE.AE + security_domain: network + asset_type: AWS Instance diff --git a/detections/detect_new_user_aws_console_login_dm.yml b/detections/detect_new_user_aws_console_login_dm.yml deleted file mode 100644 index bc63d3c9da..0000000000 --- a/detections/detect_new_user_aws_console_login_dm.yml +++ /dev/null @@ -1,102 +0,0 @@ -asset_type: AWS Instance -baselines: - - id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 - name: Previously seen users in CloudTrail - type: splunk - - id: 66ff71c2-7e01-47dd-a041-906688c9d322 - name: Update previously seen users in CloudTrail - type: splunk -confidence: medium -creation_date: '2020-04-28' -data_metadata: - data_source: - - AWS CloudTrail logs - data_model: - - Authentication - providing_technologies: - - AWS -description: This search looks for CloudTrail events wherein a console login event - by a user was recorded within the last hour, then compares the event to a lookup - file of previously seen users (by ARN values) who have logged into the console. - The alert is fired if the user has logged into the console for the first time within - the last hour -detect: - splunk: - correlation_rule: - notable: - nes_fields: user - rule_description: A new user has logged into the AWS console - rule_title: AWS Console Login by New User - risk: - risk_object: user - risk_object_type: - - user - risk_score: 30 - schedule: - cron_schedule: 5 * * * * - earliest_time: -70m@m - latest_time: -10m@m - search: | tstats earliest(_time) as firstTime latest(_time) as lastTime from - datamodel=Authentication where Authentication.signature=ConsoleLogin by - Authentication.user | rename Authentication.user as user | inputlookup append=t - previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime - max(lastTime) as lastTime by user | eval userStatus=if(firstTime >= - relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_new_user_aws_console_login_filter` - suppress: - suppress_fields: user - suppress_period: 86400s -eli5: In this search, we query CloudTrail logs to look for events that indicate that - a user has attempted to log in to the AWS console and group the events using ARN - value. Using the `previously_seen_users_console_logins.csv` lookup file created - using the support search, we compare the ARN to all the previously seen users logging - into the AWS console. The `eval` and `if` functions determine whether the earliest - time we see this user ARN was seen within the last hour. The alert will be fired - only when a user is seen for first time in the last hour. -entities: - - user -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the "Previously seen users in CloudTrail" support search only once to - create a baseline of previously seen IAM users within the last 30 days. Run "Update - previously seen users in CloudTrail" hourly (or more frequently depending on how - often you run the detection searches) to refresh the baselines. -id: 1212b18e-583e-4fe8-87c6-e27b3171f99f -investigations: - - id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 - name: AWS Investigate User Activities By ARN - type: splunk -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -maintainers: - - company: Splunk - email: bpatel@splunk.com - name: Bhavin Patel - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - Credential Access - nist: - - DE.DP - - DE.AE -modification_date: '2018-04-30' -name: Detect New User AWS Console Login -original_authors: - - company: Splunk - email: bpatel@splunk.com - name: Bhavin Patel - - company: Splunk - email: rvaldez@splunk.com - name: Rico Valdez -security_domain: network -spec_version: 2 -type: splunk -version: '1.0'