From aedfc4e837da515fbee3358f1e50b292e8a9c1b5 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Thu, 20 Aug 2020 14:07:21 -0500 Subject: [PATCH] Created manifests for unseen city, region, and country and updated logic to reflect each case --- ...ovisioning_from_previously_unseen_city.yml | 49 +++++++++++++++++++ ...sioning_from_previously_unseen_country.yml | 49 +++++++++++++++++++ ...ning_from_previously_unseen_ip_address.yml | 8 +-- ...isioning_from_previously_unseen_region.yml | 49 +++++++++++++++++++ ...ing_from_previously_unseen_city_filter.yml | 3 ++ ..._from_previously_unseen_country_filter.yml | 3 ++ ...g_from_previously_unseen_region_filter.yml | 3 ++ ...en_cloud_provisioning_activity_window.yml} | 2 +- ...spicious_cloud_provisioning_activities.yml | 30 ++++++++++++ 9 files changed, 192 insertions(+), 4 deletions(-) create mode 100644 detections/cloud_provisioning_from_previously_unseen_city.yml create mode 100644 detections/cloud_provisioning_from_previously_unseen_country.yml create mode 100644 detections/cloud_provisioning_from_previously_unseen_region.yml create mode 100644 macros/cloud_provisioning_from_previously_unseen_city_filter.yml create mode 100644 macros/cloud_provisioning_from_previously_unseen_country_filter.yml create mode 100644 macros/cloud_provisioning_from_previously_unseen_region_filter.yml rename macros/{previously_seen_cloud_provisioning_activity_window.yml => previously_unseen_cloud_provisioning_activity_window.yml} (68%) create mode 100644 stories/suspicious_cloud_provisioning_activities.yml diff --git a/detections/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud_provisioning_from_previously_unseen_city.yml new file mode 100644 index 0000000000..0f75a6e593 --- /dev/null +++ b/detections/cloud_provisioning_from_previously_unseen_city.yml @@ -0,0 +1,49 @@ +name: Cloud Provisioning Activity From Previously Unseen City +id: e7ecc5e0-88df-48b9-91af-51104c68f02f +version: 1 +date: '2020-08-16' +description: 'This search looks for cloud provisioning activities from previously unseen + cities. Provisioning activities are defined broadly as any event that runs or + creates something.' +XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from your + cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` + to build the initial table of source IP address, geographic locations, and times. You must also enable the second + baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and + to age out old data. You can adjust the time window for this search by updating the + `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by + customizing the `cloud_provisioning_from_previously_unseen_city_filter` macro. +type: ESCU +references: [] +author: Rico Valdez, Splunk +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` + | iplocation src | where isnotnull(City) + | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data + | where enough_data=1 + | eval firstTimeSeenCity=min(firstTimeSeen) + | where isnull(firstTimeSeenCity) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`") + | table firstTime, src, City, user, object, command + | `cloud_provisioning_from_previously_unseen_city_filter`' +known_false_positives: "This is a strictly behavioral search, so we define \"false\ + \ positive\" slightly differently. Every time this fires, it will accurately reflect\ + \ the first occurrence in the time period you're searching within, plus what is\ + \ stored in the cache feature. But while there are really no \"false positives\"\ + \ in a traditional sense, there is definitely lots of noise.\\\n This search will\ + \ fire any time a new IP address is seen in the **GeoIP** database for any kind\ + \ of provisioning activity. If you typically do all provisioning from tools inside\ + \ of your country, there should be few false positives. If you are located in countries\ + \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ + \ has weak resolution (particularly small countries in less economically powerful\ + \ regions), this may be much less valuable to you." +tags: + analytics_story: + - Suspicious Cloud Provisioning Activities + cis20: + - CIS 1 + nist: + - ID.AM + mitre_attack_id: + - T1078 + security_domain: endpoint + asset_type: AWS Instance diff --git a/detections/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud_provisioning_from_previously_unseen_country.yml new file mode 100644 index 0000000000..43258d4148 --- /dev/null +++ b/detections/cloud_provisioning_from_previously_unseen_country.yml @@ -0,0 +1,49 @@ +name: Cloud Provisioning Activity From Previously Unseen Country +id: e7ecc5e0-88df-48b9-91af-51104c68f02f +version: 1 +date: '2020-08-16' +description: 'This search looks for cloud provisioning activities from previously unseen + countries. Provisioning activities are defined broadly as any event that runs or + creates something.' +XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from your + cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` + to build the initial table of source IP address, geographic locations, and times. You must also enable the second + baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and + to age out old data. You can adjust the time window for this search by updating the + `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by + customizing the `cloud_provisioning_from_previously_unseen_country_filter` macro. +type: ESCU +references: [] +author: Rico Valdez, Splunk +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` + | iplocation src | where isnotnull(Country) + | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data + | where enough_data=1 + | eval firstTimeSeenSrc=min(firstTimeSeen) + | where isnull(firstTimeSeenCountry) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`") + | table firstTime, src, Country, user, object, command + | `cloud_provisioning_from_previously_unseen_ip_address_filter`' +known_false_positives: "This is a strictly behavioral search, so we define \"false\ + \ positive\" slightly differently. Every time this fires, it will accurately reflect\ + \ the first occurrence in the time period you're searching within, plus what is\ + \ stored in the cache feature. But while there are really no \"false positives\"\ + \ in a traditional sense, there is definitely lots of noise.\\\n This search will\ + \ fire any time a new IP address is seen in the **GeoIP** database for any kind\ + \ of provisioning activity. If you typically do all provisioning from tools inside\ + \ of your country, there should be few false positives. If you are located in countries\ + \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ + \ has weak resolution (particularly small countries in less economically powerful\ + \ regions), this may be much less valuable to you." +tags: + analytics_story: + - Suspicious Cloud Provisioning Activities + cis20: + - CIS 1 + nist: + - ID.AM + mitre_attack_id: + - T1078 + security_domain: endpoint + asset_type: AWS Instance diff --git a/detections/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud_provisioning_from_previously_unseen_ip_address.yml index 9d20397d95..5fce7e629f 100644 --- a/detections/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -10,7 +10,7 @@ XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from y to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the - `previously_seen_zoom_child_processes_window` macro. You can also provide additional filtering for this search by + `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_from_previously_unseen_ip_address_filter` macro. type: ESCU references: [] @@ -19,10 +19,10 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) - | lookup stuff.csv src as src OUTPUT firstTimeSeen, enough_data + | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) - | where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), "`previously_seen_cloud_provisioning_activity_window`") + | where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`") | table firstTime, src, user, object, command | `cloud_provisioning_from_previously_unseen_ip_address_filter`' known_false_positives: "This is a strictly behavioral search, so we define \"false\ @@ -43,5 +43,7 @@ tags: - CIS 1 nist: - ID.AM + mitre_attack_id: + - T1078 security_domain: endpoint asset_type: AWS Instance diff --git a/detections/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud_provisioning_from_previously_unseen_region.yml new file mode 100644 index 0000000000..c38ddeeac6 --- /dev/null +++ b/detections/cloud_provisioning_from_previously_unseen_region.yml @@ -0,0 +1,49 @@ +name: Cloud Provisioning Activity From Previously Unseen Region +id: e7ecc5e0-88df-48b9-91af-51104c68f02f +version: 1 +date: '2020-08-16' +description: 'This search looks for cloud provisioning activities from previously unseen + regions. Provisioning activities are defined broadly as any event that runs or + creates something.' +XXXhow_to_implement: You must be ingesting your cloud infrastructure logs from your + cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` + to build the initial table of source IP address, geographic locations, and times. You must also enable the second + baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and + to age out old data. You can adjust the time window for this search by updating the + `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by + customizing the `cloud_provisioning_from_previously_unseen_region_filter` macro. +type: ESCU +references: [] +author: Rico Valdez, Splunk +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` + | iplocation src | where isnotnull(Region) + | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data + | where enough_data=1 + | eval firstTimeSeenRegion=min(firstTimeSeen) + | where isnull(firstTimeSeenRegion) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`") + | table firstTime, src, Region, user, object, command + | `cloud_provisioning_from_previously_unseen_region_filter`' +known_false_positives: "This is a strictly behavioral search, so we define \"false\ + \ positive\" slightly differently. Every time this fires, it will accurately reflect\ + \ the first occurrence in the time period you're searching within, plus what is\ + \ stored in the cache feature. But while there are really no \"false positives\"\ + \ in a traditional sense, there is definitely lots of noise.\\\n This search will\ + \ fire any time a new IP address is seen in the **GeoIP** database for any kind\ + \ of provisioning activity. If you typically do all provisioning from tools inside\ + \ of your country, there should be few false positives. If you are located in countries\ + \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ + \ has weak resolution (particularly small countries in less economically powerful\ + \ regions), this may be much less valuable to you." +tags: + analytics_story: + - Suspicious Cloud Provisioning Activities + cis20: + - CIS 1 + nist: + - ID.AM + mitre_attack_id: + - T1078 + security_domain: endpoint + asset_type: AWS Instance diff --git a/macros/cloud_provisioning_from_previously_unseen_city_filter.yml b/macros/cloud_provisioning_from_previously_unseen_city_filter.yml new file mode 100644 index 0000000000..003d95cbf4 --- /dev/null +++ b/macros/cloud_provisioning_from_previously_unseen_city_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: cloud_provisioning_from_previously_unseen_cty_filter diff --git a/macros/cloud_provisioning_from_previously_unseen_country_filter.yml b/macros/cloud_provisioning_from_previously_unseen_country_filter.yml new file mode 100644 index 0000000000..ce3789ee6c --- /dev/null +++ b/macros/cloud_provisioning_from_previously_unseen_country_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: cloud_provisioning_from_previously_unseen_country_filter diff --git a/macros/cloud_provisioning_from_previously_unseen_region_filter.yml b/macros/cloud_provisioning_from_previously_unseen_region_filter.yml new file mode 100644 index 0000000000..1532c8fd4e --- /dev/null +++ b/macros/cloud_provisioning_from_previously_unseen_region_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: cloud_provisioning_from_previously_unseen_region_filter diff --git a/macros/previously_seen_cloud_provisioning_activity_window.yml b/macros/previously_unseen_cloud_provisioning_activity_window.yml similarity index 68% rename from macros/previously_seen_cloud_provisioning_activity_window.yml rename to macros/previously_unseen_cloud_provisioning_activity_window.yml index 325e424042..7bf3ec4585 100644 --- a/macros/previously_seen_cloud_provisioning_activity_window.yml +++ b/macros/previously_unseen_cloud_provisioning_activity_window.yml @@ -1,3 +1,3 @@ description: Use this macro to determine how far back you should be checking for new provisioning activities definition: -70m@m -name: previously_seen_cloud_provisioning_activity_window +name: previously_unseen_cloud_provisioning_activity_window diff --git a/stories/suspicious_cloud_provisioning_activities.yml b/stories/suspicious_cloud_provisioning_activities.yml new file mode 100644 index 0000000000..680c292c30 --- /dev/null +++ b/stories/suspicious_cloud_provisioning_activities.yml @@ -0,0 +1,30 @@ +name: Suspicious Cloud Provisioning Activities +id: 51045ded-1575-4ba6-aef7-af6c73cffd86 +version: 1 +date: '2018-08-20' +description: Monitor your cloud infrastructure provisioning activities for behaviors originating from + unfamiliar or unusual locations. These behaviors may indicate that malicious activities + are occurring somewhere within your cloud environment. +narrative: 'Because most enterprise cloud infrastructure activities originate from familiar geographic + locations, monitoring for activity from unknown or unusual regions is an important + security measure. This indicator can be especially useful in environments where + it is impossible to whitelist specific IPs (because they vary).\ + + This Analytic Story was designed to provide you with flexibility in the precision + you employ in specifying legitimate geographic regions. It can be as specific as + an IP address or a city, or as broad as a region (think state) or an entire country. + By determining how precise you want your geographical locations to be and monitoring + for new locations that haven''t previously accessed your environment, you can detect + adversaries as they begin to probe your environment. Since there are legitimate + reasons for activities from unfamiliar locations, this is not a standalone indicator. + Nevertheless, location can be a relevant piece of information that you may wish + to investigate further.' +author: David Dorsey, Splunk +type: ESCU +references: +- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf +tags: + analytics_story: AWS Suspicious Provisioning Activities + usecase: Security Monitoring + category: + - Cloud Security