new detection for aws ami share

detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml

@@ -0,0 +1,74 @@
+name: AWS AMI Atttribute Modification for Exfiltration
+id: f2132d74-cf81-4c5e-8799-ab069e67dc9f
+version: 1
+date: '2023-03-31'
+author: Bhavin Patel
+type: TTP
+datamodel:
+- Endpoint
+description: This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
+search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) 
+|  rename requestParameters.launchPermission.add.items{}.group as group_added 
+|  rename requestParameters.launchPermission.add.items{}.userId as accounts_added
+ | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")  | stats
+  count min(_time) as firstTime max(_time) as lastTime  values(group_added) values(accounts_added) as accounts_added values(ami_status) by  src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId 
+|  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_atttribute_modification_for_exfiltration_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS admin has legitimately shared a
+  snapshot with others for  a specific purpose.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
+- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
+tags:
+  analytic_story:
+  - Suspicious Cloud Instance Activities
+  - Data Exfiltration
+  asset_type: EC2 Snapshot
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$
+  mitre_attack_id:
+  - T1537
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - requestParameters.attributeType
+  - aws_account_id
+  - vendor_region
+  - user_agent
+  - userIdentity.principalId
+  risk_score: 80
+  security_domain: threat

tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml

@@ -0,0 +1,13 @@
+name: AWS AMI Atttribute Modification for Exfiltration Unit Test
+tests:
+- name: AWS AMI Atttribute Modification for Exfiltration
+  file: cloud/aws_ami_atttribute_modification_for_exfiltration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true