Created manifests for unseen city, region, and country and updated

logic to reflect each case

detections/cloud_provisioning_from_previously_unseen_city.yml

@@ -0,0 +1,49 @@
+name: Cloud Provisioning Activity From Previously Unseen City
+id: e7ecc5e0-88df-48b9-91af-51104c68f02f
+version: 1
+date: '2020-08-16'
+description: 'This search looks for cloud provisioning activities from previously unseen
+  cities. Provisioning activities are defined broadly as any event that runs or
+  creates something.'
+XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from your 
+  cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial`
+  to build the initial table of source IP address, geographic locations, and times. You must also enable the second
+  baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and
+  to age out old data. You can adjust the time window for this search by updating the
+  `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by
+  customizing the `cloud_provisioning_from_previously_unseen_city_filter` macro.
+type: ESCU
+references: []
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change 
+  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success 
+  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")`
+  | iplocation src | where isnotnull(City)
+  | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data
+  | where enough_data=1
+  | eval firstTimeSeenCity=min(firstTimeSeen)
+  | where isnull(firstTimeSeenCity) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`")
+  | table firstTime, src, City, user, object, command
+  | `cloud_provisioning_from_previously_unseen_city_filter`'
+known_false_positives: "This is a strictly behavioral search, so we define \"false\
+  \ positive\" slightly differently. Every time this fires, it will accurately reflect\
+  \ the first occurrence in the time period you're searching within, plus what is\
+  \ stored in the cache feature. But while there are really no \"false positives\"\
+  \ in a traditional sense, there is definitely lots of noise.\\\n This search will\
+  \ fire any time a new IP address is seen in the **GeoIP** database for any kind\
+  \ of provisioning activity. If you typically do all provisioning from tools inside\
+  \ of your country, there should be few false positives. If you are located in countries\
+  \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
+  \ has weak resolution (particularly small countries in less economically powerful\
+  \ regions), this may be much less valuable to you."
+tags:
+  analytics_story:
+  - Suspicious Cloud Provisioning Activities
+  cis20:
+  - CIS 1
+  nist:
+  - ID.AM
+  mitre_attack_id:
+  - T1078
+  security_domain: endpoint
+  asset_type: AWS Instance

detections/cloud_provisioning_from_previously_unseen_country.yml

@@ -0,0 +1,49 @@
+name: Cloud Provisioning Activity From Previously Unseen Country
+id: e7ecc5e0-88df-48b9-91af-51104c68f02f
+version: 1
+date: '2020-08-16'
+description: 'This search looks for cloud provisioning activities from previously unseen
+  countries. Provisioning activities are defined broadly as any event that runs or
+  creates something.'
+XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from your 
+  cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial`
+  to build the initial table of source IP address, geographic locations, and times. You must also enable the second
+  baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and
+  to age out old data. You can adjust the time window for this search by updating the
+  `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by
+  customizing the `cloud_provisioning_from_previously_unseen_country_filter` macro.
+type: ESCU
+references: []
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change 
+  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success 
+  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")`
+  | iplocation src | where isnotnull(Country)
+  | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data
+  | where enough_data=1
+  | eval firstTimeSeenSrc=min(firstTimeSeen)
+  | where isnull(firstTimeSeenCountry) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`")
+  | table firstTime, src, Country, user, object, command
+  | `cloud_provisioning_from_previously_unseen_ip_address_filter`'
+known_false_positives: "This is a strictly behavioral search, so we define \"false\
+  \ positive\" slightly differently. Every time this fires, it will accurately reflect\
+  \ the first occurrence in the time period you're searching within, plus what is\
+  \ stored in the cache feature. But while there are really no \"false positives\"\
+  \ in a traditional sense, there is definitely lots of noise.\\\n This search will\
+  \ fire any time a new IP address is seen in the **GeoIP** database for any kind\
+  \ of provisioning activity. If you typically do all provisioning from tools inside\
+  \ of your country, there should be few false positives. If you are located in countries\
+  \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
+  \ has weak resolution (particularly small countries in less economically powerful\
+  \ regions), this may be much less valuable to you."
+tags:
+  analytics_story:
+  - Suspicious Cloud Provisioning Activities
+  cis20:
+  - CIS 1
+  nist:
+  - ID.AM
+  mitre_attack_id:
+  - T1078
+  security_domain: endpoint
+  asset_type: AWS Instance

detections/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -10,7 +10,7 @@ XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from y
   to build the initial table of source IP address, geographic locations, and times. You must also enable the second
   baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and
   to age out old data. You can adjust the time window for this search by updating the
-  `previously_seen_zoom_child_processes_window` macro. You can also provide additional filtering for this search by
+  `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by
   customizing the `cloud_provisioning_from_previously_unseen_ip_address_filter` macro.
 type: ESCU
 references: []
@@ -19,10 +19,10 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
   where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success 
   by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")`
   | iplocation src | where isnotnull(Country)
-  | lookup stuff.csv src as src OUTPUT firstTimeSeen, enough_data
+  | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data
   | where enough_data=1
   | eval firstTimeSeenSrc=min(firstTimeSeen)
-  | where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), "`previously_seen_cloud_provisioning_activity_window`")
+  | where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`")
   | table firstTime, src, user, object, command
   | `cloud_provisioning_from_previously_unseen_ip_address_filter`'
 known_false_positives: "This is a strictly behavioral search, so we define \"false\
@@ -43,5 +43,7 @@ tags:
   - CIS 1
   nist:
   - ID.AM
+  mitre_attack_id:
+  - T1078
   security_domain: endpoint
   asset_type: AWS Instance

detections/cloud_provisioning_from_previously_unseen_region.yml

@@ -0,0 +1,49 @@
+name: Cloud Provisioning Activity From Previously Unseen Region
+id: e7ecc5e0-88df-48b9-91af-51104c68f02f
+version: 1
+date: '2020-08-16'
+description: 'This search looks for cloud provisioning activities from previously unseen
+  regions. Provisioning activities are defined broadly as any event that runs or
+  creates something.'
+XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from your 
+  cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial`
+  to build the initial table of source IP address, geographic locations, and times. You must also enable the second
+  baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and
+  to age out old data. You can adjust the time window for this search by updating the
+  `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by
+  customizing the `cloud_provisioning_from_previously_unseen_region_filter` macro.
+type: ESCU
+references: []
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change 
+  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success 
+  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")`
+  | iplocation src | where isnotnull(Region)
+  | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data
+  | where enough_data=1
+  | eval firstTimeSeenRegion=min(firstTimeSeen)
+  | where isnull(firstTimeSeenRegion) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`")
+  | table firstTime, src, Region, user, object, command
+  | `cloud_provisioning_from_previously_unseen_region_filter`'
+known_false_positives: "This is a strictly behavioral search, so we define \"false\
+  \ positive\" slightly differently. Every time this fires, it will accurately reflect\
+  \ the first occurrence in the time period you're searching within, plus what is\
+  \ stored in the cache feature. But while there are really no \"false positives\"\
+  \ in a traditional sense, there is definitely lots of noise.\\\n This search will\
+  \ fire any time a new IP address is seen in the **GeoIP** database for any kind\
+  \ of provisioning activity. If you typically do all provisioning from tools inside\
+  \ of your country, there should be few false positives. If you are located in countries\
+  \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
+  \ has weak resolution (particularly small countries in less economically powerful\
+  \ regions), this may be much less valuable to you."
+tags:
+  analytics_story:
+  - Suspicious Cloud Provisioning Activities
+  cis20:
+  - CIS 1
+  nist:
+  - ID.AM
+  mitre_attack_id:
+  - T1078
+  security_domain: endpoint
+  asset_type: AWS Instance

macros/cloud_provisioning_from_previously_unseen_city_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: cloud_provisioning_from_previously_unseen_cty_filter

macros/cloud_provisioning_from_previously_unseen_country_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: cloud_provisioning_from_previously_unseen_country_filter

macros/cloud_provisioning_from_previously_unseen_region_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: cloud_provisioning_from_previously_unseen_region_filter

macros/previously_unseen_cloud_provisioning_activity_window.yml

@@ -1,3 +1,3 @@
 description: Use this macro to determine how far back you should be checking for new provisioning activities
 definition: -70m@m
-name: previously_seen_cloud_provisioning_activity_window
+name: previously_unseen_cloud_provisioning_activity_window

stories/suspicious_cloud_provisioning_activities.yml

@@ -0,0 +1,30 @@
+name: Suspicious Cloud Provisioning Activities
+id: 51045ded-1575-4ba6-aef7-af6c73cffd86
+version: 1
+date: '2018-08-20'
+description: Monitor your cloud infrastructure provisioning activities for behaviors originating from
+  unfamiliar or unusual locations. These behaviors may indicate that malicious activities
+  are occurring somewhere within your cloud environment.
+narrative: 'Because most enterprise cloud infrastructure activities originate from familiar geographic
+  locations, monitoring for activity from unknown or unusual regions is an important
+  security measure. This indicator can be especially useful in environments where
+  it is impossible to whitelist specific IPs (because they vary).\
+
+  This Analytic Story was designed to provide you with flexibility in the precision
+  you employ in specifying legitimate geographic regions. It can be as specific as
+  an IP address or a city, or as broad as a region (think state) or an entire country.
+  By determining how precise you want your geographical locations to be and monitoring
+  for new locations that haven''t previously accessed your environment, you can detect
+  adversaries as they begin to probe your environment. Since there are legitimate
+  reasons for activities from unfamiliar locations, this is not a standalone indicator.
+  Nevertheless, location can be a relevant piece of information that you may wish
+  to investigate further.'
+author: David Dorsey, Splunk
+type: ESCU
+references:
+- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
+tags:
+  analytics_story: AWS Suspicious Provisioning Activities
+  usecase: Security Monitoring
+  category:
+  - Cloud Security