From b64ca7010c24d58c8564ce4723158429c6dfa6fe Mon Sep 17 00:00:00 2001 From: bpatel Date: Fri, 9 Oct 2020 10:23:53 -0700 Subject: [PATCH] seearch bugs --- ...detect_accounts_with_high_risk_roles_by_project.yml | 10 +++++----- detections/gcp_detect_gcploit_framework.yml | 10 +++++----- ...t_high_risk_permissions_by_resource_and_account.yml | 10 +++++----- detections/gcp_detect_oauth_token_abuse.yml | 8 ++++---- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml index 82265286f9..2bf308813d 100644 --- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -4,20 +4,20 @@ description: "This search provides detection of accounts with high risk roles by how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: 27af8c15-38b0-4408-b339-920170724adb known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization" -name: "gcp detect accounts with high risk roles by project" +name: GCP Detect accounts with high risk roles by project references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/understanding-roles -search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project` +search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`" tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml index 9c8ce1e719..d247bb8014 100644 --- a/detections/gcp_detect_gcploit_framework.yml +++ b/detections/gcp_detect_gcploit_framework.yml @@ -4,19 +4,19 @@ description: "This search provides detection of GCPloit exploitation framework. how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: a1c5a85e-a162-410c-a5d9-99ff639e5a52 known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects" -name: "gcp detect gcploit framework" +name: GCP Detect gcploit framework references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok -search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework` +search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`" tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml index d4eece9b83..8495c184eb 100644 --- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -4,20 +4,20 @@ description: "This search provides detection of high risk permissions by resourc how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: 2e70ef35-2187-431f-aedc-4503dc9b06ba known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives." -name: "gcp detect high risk permissions by resource and account" +name: GCP Detect high risk permissions by resource and account references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/permissions-reference -search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account` +search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`" tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 diff --git a/detections/gcp_detect_oauth_token_abuse.yml b/detections/gcp_detect_oauth_token_abuse.yml index 3b6fa23ebd..fa55c444ec 100644 --- a/detections/gcp_detect_oauth_token_abuse.yml +++ b/detections/gcp_detect_oauth_token_abuse.yml @@ -8,15 +8,15 @@ name: "gcp detect oauth token abuse" references: - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1 - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-2 -search: '`sourcetype=google:gcp:pubsub:message type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse`' +search: '`google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse_filter`' tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1