From b581bfda8a3471666bfee253c342b35ecaab4954 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 31 Mar 2023 15:06:02 -0500
Subject: [PATCH] new detection for aws ami share

---
 ...ttribute_modification_for_exfiltration.yml | 74 +++++++++++++++++++
 ...ute_modification_for_exfiltration.test.yml | 13 ++++
 2 files changed, 87 insertions(+)
 create mode 100644 detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
 create mode 100644 tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml

diff --git a/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
new file mode 100644
index 0000000000..3c1bc1ce89
--- /dev/null
+++ b/detections/cloud/aws_ami_atttribute_modification_for_exfiltration.yml
@@ -0,0 +1,74 @@
+name: AWS AMI Atttribute Modification for Exfiltration
+id: f2132d74-cf81-4c5e-8799-ab069e67dc9f
+version: 1
+date: '2023-03-31'
+author: Bhavin Patel
+type: TTP
+datamodel:
+- Endpoint
+description: This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
+search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) 
+|  rename requestParameters.launchPermission.add.items{}.group as group_added 
+|  rename requestParameters.launchPermission.add.items{}.userId as accounts_added
+ | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")  | stats
+  count min(_time) as firstTime max(_time) as lastTime  values(group_added) values(accounts_added) as accounts_added values(ami_status) by  src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId 
+|  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_atttribute_modification_for_exfiltration_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that an AWS admin has legitimately shared a
+  snapshot with others for  a specific purpose.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
+- https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
+tags:
+  analytic_story:
+  - Suspicious Cloud Instance Activities
+  - Data Exfiltration
+  asset_type: EC2 Snapshot
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: AWS AMI from account $aws_account_id$ is shared externally with $accounts_added$ from $src_ip$
+  mitre_attack_id:
+  - T1537
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - requestParameters.attributeType
+  - aws_account_id
+  - vendor_region
+  - user_agent
+  - userIdentity.principalId
+  risk_score: 80
+  security_domain: threat
\ No newline at end of file
diff --git a/tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml b/tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml
new file mode 100644
index 0000000000..ec645dfd2a
--- /dev/null
+++ b/tests/cloud/aws_ami_atttribute_modification_for_exfiltration.test.yml
@@ -0,0 +1,13 @@
+name: AWS AMI Atttribute Modification for Exfiltration Unit Test
+tests:
+- name: AWS AMI Atttribute Modification for Exfiltration
+  file: cloud/aws_ami_atttribute_modification_for_exfiltration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true