tweaks and updates

baselines/previously_seen_aws_cross_account_activity_initial.yml

@@ -10,4 +10,4 @@ tags:
   analytics_story:
   - Suspicious Cloud Authentication Activities 
   detections:
-  - AWS Cross Account Activity From Previously Unseen Account - DM
+  - AWS Cross Account Activity From Previously Unseen Account 

baselines/previously_seen_aws_cross_account_activity_update.yml

@@ -15,5 +15,5 @@ tags:
   analytics_story:
   - Suspicious Cloud Authentication Activities 
   detections:
-  - AWS Cross Account Activity From Previously Unseen Account - DM
+  - AWS Cross Account Activity From Previously Unseen Account
 

baselines/previously_seen_cloud_compute_creations_by_user_initial.yml

@@ -16,4 +16,4 @@ tags:
   analytics_story:
   - Cloud Cryptomining
   detections:
-  - Cloud Compute Instance Created By Previously Unseen User - DM
+  - Cloud Compute Instance Created By Previously Unseen User

baselines/previously_seen_cloud_compute_creations_by_user_update.yml

@@ -1,4 +1,4 @@
-name: Previously Seen Cloud Compute Creations By User - Update - DM
+name: Previously Seen Cloud Compute Creations By User - Update
 id: 6bf75d69-7766-47bc-8097-e41696807a6f
 version: 1
 date: '2020-08-15'
@@ -17,4 +17,4 @@ tags:
   analytics_story:
   - Cloud Cryptomining
   detections:
-  - Cloud Compute Instance Created By Previously Unseen User - DM
+  - Cloud Compute Instance Created By Previously Unseen User

baselines/previously_seen_users_in_cloudtrail_initial.yml

@@ -1,4 +1,4 @@
-name: Previously seen users in CloudTrail - DM
+name: Previously seen users in CloudTrail - Initial
 id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
 version: 1
 date: '2020-05-28'

baselines/previously_seen_users_in_cloudtrail_update.yml

@@ -1,4 +1,4 @@
-name: Update previously seen users in CloudTrail - DM
+name: Previously Seen Users In CloudTrail - Update
 id: 66ff71c2-7e01-47dd-a041-906688c9d322
 version: 1
 date: '2020-05-28'

detections/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -1,41 +1,34 @@
-name: AWS Cross Account Activity From Previously Unseen Account
-id: 64fbbddf-fabf-4edf-80b3-0cc36ef37727
-version: 4
-date: '2020-07-21'
+name: AWS Cross Account Activity From Previously Unseen Account - DM
+id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
+version: 1
+date: '2020-05-28'
 description: This search looks for AssumeRole events where an IAM role in a different
   account is requested for the first time.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Run the `Previously Seen AWS Cross Account Activity` support search only
-  once to create the baseline of previously seen cross account activity. Thanks to
-  Pablo Vega at Recurly for suggesting improvements to the search.
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
+  and Enterprise Security 6.2, which contains the required updates to the Authentication data model
+  for cloud use cases. Run the `Previously Seen AWS Cross Account Activity - DM` support search only
+  once to create the baseline of previously seen cross account activity. 
 type: ESCU
 references: []
-author: David Dorsey, Splunk
-search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
-  | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
-  | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity
-  | multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time)))
-  as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity
-  | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime,
-  max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime
-  >= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId
-  path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN
-  | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime)
-  as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user,
-  values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId,
-  requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId,
-  dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`'
+author: Rico Valdez, Splunk
+search: "| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication
+  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
+  Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
+  requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity
+  requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest
+  | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) 
+  | where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId,
+  requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime | `aws_cross_account_activity_from_previously_unseen_account_filter`"
 known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
   It's suspicious when an account requests privileges of an account it hasn't before.
   You should validate with the account owner that this is a legitimate request.
 tags:
   analytics_story:
-  - AWS Cross Account Activity
+  - Suspicious Cloud Authentication Activities
   kill_chain_phases:
   - Actions on Objectives
-  mitre_attack_id:
-  - T1078.004
   cis20:
   - CIS 16
   nist:

detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml

@@ -1,39 +0,0 @@
-name: AWS Cross Account Activity From Previously Unseen Account - DM
-id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
-version: 1
-date: '2020-05-28'
-description: This search looks for AssumeRole events where an IAM role in a different
-  account is requested for the first time.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
-  and Enterprise Security 6.2, which contains the required updates to the Authentication data model
-  for cloud use cases. Run the `Previously Seen AWS Cross Account Activity - DM` support search only
-  once to create the baseline of previously seen cross account activity. 
-type: ESCU
-references: []
-author: Rico Valdez, Splunk
-search: "| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication
-  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
-  Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
-  requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity
-  requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest
-  | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) 
-  | where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId,
-  requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime | `aws_cross_account_activity_from_previously_unseen_account___dm_filter`"
-known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
-  It's suspicious when an account requests privileges of an account it hasn't before.
-  You should validate with the account owner that this is a legitimate request.
-tags:
-  analytics_story:
-  - Suspicious Cloud Authentication Activities
-  kill_chain_phases:
-  - Actions on Objectives
-  cis20:
-  - CIS 16
-  nist:
-  - PR.AC
-  - PR.DS
-  - DE.AE
-  security_domain: network
-  asset_type: AWS Instance