From b3eeaef59da8b03bd4d3f4abf1fd7957308fa338 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Thu, 10 Sep 2020 14:19:45 -0600 Subject: [PATCH] tweaks and updates --- ...een_aws_cross_account_activity_initial.yml | 2 +- ...seen_aws_cross_account_activity_update.yml | 2 +- ...loud_compute_creations_by_user_initial.yml | 2 +- ...cloud_compute_creations_by_user_update.yml | 4 +- ...usly_seen_users_in_cloudtrail_initial.yml} | 2 +- ...ously_seen_users_in_cloudtrail_update.yml} | 2 +- ...ctivity_from_previously_unseen_account.yml | 47 ++++++++----------- ...ty_from_previously_unseen_account___dm.yml | 39 --------------- 8 files changed, 27 insertions(+), 73 deletions(-) rename baselines/{previously_seen_users_in_cloudtrail___dm.yml => previously_seen_users_in_cloudtrail_initial.yml} (96%) rename baselines/{update_previously_seen_users_in_cloudtrail___dm.yml => previously_seen_users_in_cloudtrail_update.yml} (96%) delete mode 100644 detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml diff --git a/baselines/previously_seen_aws_cross_account_activity_initial.yml b/baselines/previously_seen_aws_cross_account_activity_initial.yml index 0adc509f27..17080e3bde 100644 --- a/baselines/previously_seen_aws_cross_account_activity_initial.yml +++ b/baselines/previously_seen_aws_cross_account_activity_initial.yml @@ -10,4 +10,4 @@ tags: analytics_story: - Suspicious Cloud Authentication Activities detections: - - AWS Cross Account Activity From Previously Unseen Account - DM \ No newline at end of file + - AWS Cross Account Activity From Previously Unseen Account diff --git a/baselines/previously_seen_aws_cross_account_activity_update.yml b/baselines/previously_seen_aws_cross_account_activity_update.yml index fdb9e855cf..09381dfc2b 100644 --- a/baselines/previously_seen_aws_cross_account_activity_update.yml +++ b/baselines/previously_seen_aws_cross_account_activity_update.yml @@ -15,5 +15,5 @@ tags: analytics_story: - Suspicious Cloud Authentication Activities detections: - - AWS Cross Account Activity From Previously Unseen Account - DM + - AWS Cross Account Activity From Previously Unseen Account diff --git a/baselines/previously_seen_cloud_compute_creations_by_user_initial.yml b/baselines/previously_seen_cloud_compute_creations_by_user_initial.yml index c910493919..f69473d200 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user_initial.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user_initial.yml @@ -16,4 +16,4 @@ tags: analytics_story: - Cloud Cryptomining detections: - - Cloud Compute Instance Created By Previously Unseen User - DM + - Cloud Compute Instance Created By Previously Unseen User diff --git a/baselines/previously_seen_cloud_compute_creations_by_user_update.yml b/baselines/previously_seen_cloud_compute_creations_by_user_update.yml index 2e51c94b81..f91f096487 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user_update.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user_update.yml @@ -1,4 +1,4 @@ -name: Previously Seen Cloud Compute Creations By User - Update - DM +name: Previously Seen Cloud Compute Creations By User - Update id: 6bf75d69-7766-47bc-8097-e41696807a6f version: 1 date: '2020-08-15' @@ -17,4 +17,4 @@ tags: analytics_story: - Cloud Cryptomining detections: - - Cloud Compute Instance Created By Previously Unseen User - DM + - Cloud Compute Instance Created By Previously Unseen User diff --git a/baselines/previously_seen_users_in_cloudtrail___dm.yml b/baselines/previously_seen_users_in_cloudtrail_initial.yml similarity index 96% rename from baselines/previously_seen_users_in_cloudtrail___dm.yml rename to baselines/previously_seen_users_in_cloudtrail_initial.yml index 2e9c19a865..4bb6b97b09 100644 --- a/baselines/previously_seen_users_in_cloudtrail___dm.yml +++ b/baselines/previously_seen_users_in_cloudtrail_initial.yml @@ -1,4 +1,4 @@ -name: Previously seen users in CloudTrail - DM +name: Previously seen users in CloudTrail - Initial id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 version: 1 date: '2020-05-28' diff --git a/baselines/update_previously_seen_users_in_cloudtrail___dm.yml b/baselines/previously_seen_users_in_cloudtrail_update.yml similarity index 96% rename from baselines/update_previously_seen_users_in_cloudtrail___dm.yml rename to baselines/previously_seen_users_in_cloudtrail_update.yml index 79a2e22a13..12b0456302 100644 --- a/baselines/update_previously_seen_users_in_cloudtrail___dm.yml +++ b/baselines/previously_seen_users_in_cloudtrail_update.yml @@ -1,4 +1,4 @@ -name: Update previously seen users in CloudTrail - DM +name: Previously Seen Users In CloudTrail - Update id: 66ff71c2-7e01-47dd-a041-906688c9d322 version: 1 date: '2020-05-28' diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/aws_cross_account_activity_from_previously_unseen_account.yml index 55ada1318b..5d69aa8824 100644 --- a/detections/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/aws_cross_account_activity_from_previously_unseen_account.yml @@ -1,41 +1,34 @@ -name: AWS Cross Account Activity From Previously Unseen Account -id: 64fbbddf-fabf-4edf-80b3-0cc36ef37727 -version: 4 -date: '2020-07-21' +name: AWS Cross Account Activity From Previously Unseen Account - DM +id: 21193641-cb96-4a2c-a707-d9b9a7f7792b +version: 1 +date: '2020-05-28' description: This search looks for AssumeRole events where an IAM role in a different account is requested for the first time. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Run the `Previously Seen AWS Cross Account Activity` support search only - once to create the baseline of previously seen cross account activity. Thanks to - Pablo Vega at Recurly for suggesting improvements to the search. +how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) + and Enterprise Security 6.2, which contains the required updates to the Authentication data model + for cloud use cases. Run the `Previously Seen AWS Cross Account Activity - DM` support search only + once to create the baseline of previously seen cross account activity. type: ESCU references: [] -author: David Dorsey, Splunk -search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId - | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* - | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity - | multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time))) - as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity - | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime, - max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime - >= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId - path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN - | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime) - as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user, - values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId, - requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId, - dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`' +author: Rico Valdez, Splunk +search: "| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication + where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src + Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as + requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity + requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest + | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) + | where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId, + requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime | `aws_cross_account_activity_from_previously_unseen_account_filter`" known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request. tags: analytics_story: - - AWS Cross Account Activity + - Suspicious Cloud Authentication Activities kill_chain_phases: - Actions on Objectives - mitre_attack_id: - - T1078.004 cis20: - CIS 16 nist: diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml deleted file mode 100644 index d475e49139..0000000000 --- a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: AWS Cross Account Activity From Previously Unseen Account - DM -id: 21193641-cb96-4a2c-a707-d9b9a7f7792b -version: 1 -date: '2020-05-28' -description: This search looks for AssumeRole events where an IAM role in a different - account is requested for the first time. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) - and Enterprise Security 6.2, which contains the required updates to the Authentication data model - for cloud use cases. Run the `Previously Seen AWS Cross Account Activity - DM` support search only - once to create the baseline of previously seen cross account activity. -type: ESCU -references: [] -author: Rico Valdez, Splunk -search: "| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication - where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src - Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as - requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity - requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest - | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) - | where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId, - requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime | `aws_cross_account_activity_from_previously_unseen_account___dm_filter`" -known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior. - It's suspicious when an account requests privileges of an account it hasn't before. - You should validate with the account owner that this is a legitimate request. -tags: - analytics_story: - - Suspicious Cloud Authentication Activities - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 16 - nist: - - PR.AC - - PR.DS - - DE.AE - security_domain: network - asset_type: AWS Instance