admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inCloud Instance Modified By Previously Unseen User

Browse Source
This commit is contained in:
root
2020-12-01 20:17:56 +00:00
parent 241a01119c
commit b56cce1dc0
1 changed files with 16 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+16 -19
View File
@@ -4,27 +4,22 @@ version: 1
date: '2020-07-29'
description: This search looks for cloud instances being modified by users who have
not previously modified them.
how_to_implement: This search has a dependency on other searches to create and update a
baseline of users observed to be associated with this activity. The search
"Previously Seen Cloud Instance Modifications By User - Update" should be enabled for
this detection to properly work.
how_to_implement: This search has a dependency on other searches to create and update
a baseline of users observed to be associated with this activity. The search "Previously
Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
to properly work.
type: ESCU
references: []
author: Rico Valdez, Splunk
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time)
as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change
where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user
| `drop_dm_object_name("All_Changes")`
| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
| eventstats max(enough_data) as enough_data
| where enough_data=1
| eval firstTimeSeenUser=min(firstTimeSeen)
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
| table firstTime user command object_id count
| `security_content_ctime(firstTime)`
| `cloud_instance_modified_by_previously_unseen_user_filter`'
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser)
OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command
object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`'
known_false_positives: It's possible that a new user will start to modify EC2 instances
when they haven't before for any number of reasons. Verify with the user that is
modifying instances that this is the intended behavior.
@@ -42,4 +37,6 @@ tags:
risk_score: 10
risk_object_type: user
risk_object: user
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json