From 4d714cd6f6b5fe34d19629f41aa246597c6c7e17 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 20 Jul 2021 12:55:18 -0700 Subject: [PATCH 1/4] snap --- .../cloud/detect_shared_ec2_snapshot.yml | 73 +++++++++++++++++++ .../cloud/detect_shared_ec2_snapshot.test.yml | 13 ++++ 2 files changed, 86 insertions(+) create mode 100644 detections/cloud/detect_shared_ec2_snapshot.yml create mode 100644 tests/cloud/detect_shared_ec2_snapshot.test.yml diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml new file mode 100644 index 0000000000..075c9bca7f --- /dev/null +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -0,0 +1,73 @@ +name: Detect shared ec2 snapshot +id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 +version: 2 +date: '2021-07-20' +author: Bhavin Patel, Splunk +type: batch +datamodel: [] +description: This search looks for AWS CloudTrail events an EC2 snapshot is shared with a different AWS account +search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL +| eval match=if(requested_account_id==aws_account_id,"Match","No Match") +| table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" + | `detect_shared_ec2_snapshot_filter` ' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately created a public bucket for a specific purpose. + That said, AWS strongly advises against granting full control to the "All Users" + group. +references: + - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +tags: + analytic_story: + - Suspicious Cloud Instance Activities + - Data Exfiltration + asset_type: EC2 Snapshot + cis20: + - CIS 13 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1537 + nist: + - PR.DS + - PR.AC + - DE.CM + product: + - Splunk Security Analytics for AWS + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - user_arn + - src_ip + - requestParameters.attributeType + - aws_account_id + - vendor_region + - user_agent + + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + - Stage:Exfiltration + message: User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$ + observable: + - name: userName + type: User + role: + - Attacker + - name: bucketName + type: Other + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/tests/cloud/detect_shared_ec2_snapshot.test.yml b/tests/cloud/detect_shared_ec2_snapshot.test.yml new file mode 100644 index 0000000000..0da52d9b55 --- /dev/null +++ b/tests/cloud/detect_shared_ec2_snapshot.test.yml @@ -0,0 +1,13 @@ +name: Detect shared ec2 snapshot Unit Test +tests: +- name: Detect shared ec2 snapshot + file: cloud/detect_shared_ec2_snapshot.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True From 4a1841fbedb94adbc3608836081885d321593330 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 20 Jul 2021 15:37:36 -0700 Subject: [PATCH 2/4] updates --- .../cloud/detect_shared_ec2_snapshot.yml | 19 +++++++------------ .../cloud/detect_shared_ec2_snapshot.test.yml | 2 +- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index 075c9bca7f..d6e6f9c1b8 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -5,17 +5,14 @@ date: '2021-07-20' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events an EC2 snapshot is shared with a different AWS account +description: This search looks for AWS CloudTrail events where an EC2 snapshot permissions are modified to be shared with a different AWS account. search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` ' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -known_false_positives: While this search has no known false positives, it is possible - that an AWS admin has legitimately created a public bucket for a specific purpose. - That said, AWS strongly advises against granting full control to the "All Users" - group. +known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. references: - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ tags: @@ -25,8 +22,6 @@ tags: asset_type: EC2 Snapshot cis20: - CIS 13 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json kill_chain_phases: - Actions on Objectives mitre_attack_id: @@ -60,14 +55,14 @@ tags: - Outcome:Allowed - Stage:Execution - Stage:Exfiltration - message: User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$ + message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ observable: - - name: userName + - name: user_arn type: User role: - Attacker - - name: bucketName - type: Other + - name: src_ip + type: IP Address role: - - Victim + - Attacker security_domain: threat \ No newline at end of file diff --git a/tests/cloud/detect_shared_ec2_snapshot.test.yml b/tests/cloud/detect_shared_ec2_snapshot.test.yml index 0da52d9b55..30b73d459e 100644 --- a/tests/cloud/detect_shared_ec2_snapshot.test.yml +++ b/tests/cloud/detect_shared_ec2_snapshot.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: aws_cloudtrail_events.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail update_timestamp: True From 0dbf7fdab6dbdb60aeaaebe7e55fb830dd84d589 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 20 Jul 2021 23:41:56 +0000 Subject: [PATCH 3/4] Added detection testing service results inDetect shared ec2 snapshot --- .../cloud/detect_shared_ec2_snapshot.yml | 36 ++++++++++--------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index d6e6f9c1b8..19fd4a8cdd 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -5,16 +5,18 @@ date: '2021-07-20' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where an EC2 snapshot permissions are modified to be shared with a different AWS account. -search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL -| eval match=if(requested_account_id==aws_account_id,"Match","No Match") -| table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" - | `detect_shared_ec2_snapshot_filter` ' +description: This search looks for AWS CloudTrail events where an EC2 snapshot permissions + are modified to be shared with a different AWS account. +search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId + as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No + Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id + aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` ' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. -references: - - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ +known_false_positives: It is possible that an AWS admin has legitimately shared a + snapshot with others for a specific purpose. +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ tags: analytic_story: - Suspicious Cloud Instance Activities @@ -40,14 +42,12 @@ tags: - eventName - user_arn - src_ip - - requestParameters.attributeType - - aws_account_id - - vendor_region - - user_agent - + - requestParameters.attributeType + - aws_account_id + - vendor_region + - user_agent impact: 60 confidence: 80 - # (impact * confidence)/100 risk_score: 48 context: - Source:Cloud Data @@ -55,7 +55,8 @@ tags: - Outcome:Allowed - Stage:Execution - Stage:Exfiltration - message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ + message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ + by user $user_arn$ from $src_ip$ observable: - name: user_arn type: User @@ -65,4 +66,7 @@ tags: type: IP Address role: - Attacker - security_domain: threat \ No newline at end of file + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json From ad44baef29be081d7a30a6b632c14ee4280dc1d8 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Jul 2021 13:06:23 -0600 Subject: [PATCH 4/4] Update detect_shared_ec2_snapshot.yml --- detections/cloud/detect_shared_ec2_snapshot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index 19fd4a8cdd..2fb3c3312a 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -5,8 +5,8 @@ date: '2021-07-20' author: Bhavin Patel, Splunk type: batch datamodel: [] -description: This search looks for AWS CloudTrail events where an EC2 snapshot permissions - are modified to be shared with a different AWS account. +description: The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions + are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id