mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
seearch bugs
This commit is contained in:
bpatel
@@ -4,20 +4,20 @@ description: "This search provides detection of accounts with high risk roles by
|
||||
how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
|
||||
id: 27af8c15-38b0-4408-b339-920170724adb
|
||||
known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization"
|
||||
name: "gcp detect accounts with high risk roles by project"
|
||||
name: GCP Detect accounts with high risk roles by project
|
||||
references:
|
||||
- https://github.com/dxa4481/gcploit
|
||||
- https://www.youtube.com/watch?v=Ml09R38jpok
|
||||
- https://cloud.google.com/iam/docs/understanding-roles
|
||||
search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`
|
||||
search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`"
|
||||
tags:
|
||||
analytics_story:
|
||||
- "GCP Cross Account Activity"
|
||||
- GCP Cross Account Activity
|
||||
asset_type: "GCP Account"
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
- Lateral Movement
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078
|
||||
security_domain: threat
|
||||
type: ESCU
|
||||
version: 1
|
||||
|
||||
@@ -4,19 +4,19 @@ description: "This search provides detection of GCPloit exploitation framework.
|
||||
how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
|
||||
id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
|
||||
known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
|
||||
name: "gcp detect gcploit framework"
|
||||
name: GCP Detect gcploit framework
|
||||
references:
|
||||
- https://github.com/dxa4481/gcploit
|
||||
- https://www.youtube.com/watch?v=Ml09R38jpok
|
||||
search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`
|
||||
search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`"
|
||||
tags:
|
||||
analytics_story:
|
||||
- "GCP Cross Account Activity"
|
||||
- GCP Cross Account Activity
|
||||
asset_type: "GCP Account"
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
- Lateral Movement
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078
|
||||
security_domain: threat
|
||||
type: ESCU
|
||||
version: 1
|
||||
|
||||
@@ -4,20 +4,20 @@ description: "This search provides detection of high risk permissions by resourc
|
||||
how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
|
||||
id: 2e70ef35-2187-431f-aedc-4503dc9b06ba
|
||||
known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives."
|
||||
name: "gcp detect high risk permissions by resource and account"
|
||||
name: GCP Detect high risk permissions by resource and account
|
||||
references:
|
||||
- https://github.com/dxa4481/gcploit
|
||||
- https://www.youtube.com/watch?v=Ml09R38jpok
|
||||
- https://cloud.google.com/iam/docs/permissions-reference
|
||||
search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account`
|
||||
search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`"
|
||||
tags:
|
||||
analytics_story:
|
||||
- "GCP Cross Account Activity"
|
||||
- GCP Cross Account Activity
|
||||
asset_type: "GCP Account"
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
- Lateral Movement
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078
|
||||
security_domain: threat
|
||||
type: ESCU
|
||||
version: 1
|
||||
|
||||
@@ -8,15 +8,15 @@ name: "gcp detect oauth token abuse"
|
||||
references:
|
||||
- https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1
|
||||
- https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-2
|
||||
search: '`sourcetype=google:gcp:pubsub:message type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse`'
|
||||
search: '`google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse_filter`'
|
||||
tags:
|
||||
analytics_story:
|
||||
- "GCP Cross Account Activity"
|
||||
- GCP Cross Account Activity
|
||||
asset_type: "GCP Account"
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
- Lateral Movement
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078
|
||||
security_domain: threat
|
||||
type: ESCU
|
||||
version: 1
|
||||
|
||||
Reference in New Issue
Block a user