mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -0,0 +1,68 @@
|
||||
name: AWS Console Login Failed During MFA Challenge
|
||||
id: 55349868-5583-466f-98ab-d3beb321961e
|
||||
version: 1
|
||||
date: '2022-10-03'
|
||||
author: Bhavin Patel, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled.
|
||||
search: '`cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode errorMessage
|
||||
userAgent eventID awsRegion user_name userIdentity.arn | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`| `aws_console_login_failed_during_mfa_challenge_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1621/
|
||||
- https://aws.amazon.com/what-is/mfa/
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS Identity and Access Management Account Takeover
|
||||
asset_type: AWS Account
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Cloud Data
|
||||
- Outcome:Blocked
|
||||
- Stage:Recon
|
||||
- Other:Brute Force
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: User $user_name$ failed to pass MFA challenge while logging into console from $src$
|
||||
mitre_attack_id:
|
||||
- T1621
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: user_name
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: src
|
||||
type: IP Address
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- src
|
||||
- eventName
|
||||
- eventSource
|
||||
- aws_account_id
|
||||
- errorCode
|
||||
- errorMessage
|
||||
- userAgent
|
||||
- eventID
|
||||
- awsRegion
|
||||
- user_name
|
||||
- userIdentity.arn
|
||||
risk_score: 64
|
||||
security_domain: threat
|
||||
@@ -0,0 +1,73 @@
|
||||
name: AWS Multi-Factor Authentication Disabled
|
||||
id: 374832b1-3603-420c-b456-b373e24d34c0
|
||||
version: 1
|
||||
date: '2022-10-04'
|
||||
author: Bhavin Patel, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies an attempt to disable multi-factor authentication for an AWS IAM user. An adversary who has obtained access to an AWS tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users.
|
||||
search: '`cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice)
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id
|
||||
userAgent eventID awsRegion user_name userIdentity.arn status | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `aws_multi_factor_authentication_disabled_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1621/
|
||||
- https://aws.amazon.com/what-is/mfa/
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS Identity and Access Management Account Takeover
|
||||
asset_type: AWS Account
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Cloud Data
|
||||
- Outcome:Blocked
|
||||
- Stage:Recon
|
||||
- Other:Brute Force
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail.json
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$
|
||||
mitre_attack_id:
|
||||
- T1621
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: aws_account_id
|
||||
type: Other
|
||||
role:
|
||||
- Victim
|
||||
- name: user_name
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: src
|
||||
type: IP Address
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- src
|
||||
- eventName
|
||||
- eventSource
|
||||
- aws_account_id
|
||||
- errorCode
|
||||
- errorMessage
|
||||
- userAgent
|
||||
- eventID
|
||||
- awsRegion
|
||||
- user_name
|
||||
- userIdentity.arn
|
||||
risk_score: 64
|
||||
security_domain: threat
|
||||
@@ -0,0 +1,66 @@
|
||||
name: AWS Multiple Failed MFA Requests For User
|
||||
id: 1fece617-e614-4329-9e61-3ba228c0f353
|
||||
version: 1
|
||||
date: '2022-10-03'
|
||||
author: Bhavin Patel
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: The following analytic identifies multiple failed multi-factor authentication requests to an AWS Console for a single user. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. AWS Environments can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
|
||||
search: '`cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication" | bucket span=5m _time
|
||||
| stats dc(_raw) as mfa_prompts values(userAgent) as userAgent values(src) as src by _time user_name user_arn aws_account_id eventName errorMessage | where mfa_prompts > 10| `aws_multiple_failed_mfa_requests_for_user_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1621/
|
||||
- https://aws.amazon.com/what-is/mfa/
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS Identity and Access Management Account Takeover
|
||||
asset_type: AWS Account
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Cloud Data
|
||||
- Outcome:Blocked
|
||||
- Stage:Recon
|
||||
- Other:Brute Force
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: User $user_name$ is seen to have high number of MFA prompt failures within a short period of time.
|
||||
mitre_attack_id:
|
||||
- T1621
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: user_name
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: src
|
||||
type: IP Address
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- src
|
||||
- eventName
|
||||
- eventSource
|
||||
- aws_account_id
|
||||
- errorCode
|
||||
- errorMessage
|
||||
- userAgent
|
||||
- eventID
|
||||
- awsRegion
|
||||
- user_name
|
||||
- userIdentity.arn
|
||||
risk_score: 64
|
||||
security_domain: threat
|
||||
@@ -0,0 +1,65 @@
|
||||
name: AWS Successful Single-Factor Authentication
|
||||
id: a520b1fe-cc9e-4f56-b762-18354594c52f
|
||||
version: 1
|
||||
date: '2022-10-04'
|
||||
author: Bhavin Patel, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a successful Console Login authentication event against an AWS IAM user for an account without Multi-Factor Authentication enabled. This could be evidence of a misconfiguration, a policy violation or an account take over attempt that should be investigated
|
||||
search: '`cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode additionalEventData.MFAUsed userAgent eventID awsRegion user_name userIdentity.arn | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `aws_successful_single_factor_authentication_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: It is possible that some accounts do not have MFA enabled for the AWS account however its agaisnt the best practices of securing AWS.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1621/
|
||||
- https://attack.mitre.org/techniques/T1078/004/
|
||||
- https://aws.amazon.com/what-is/mfa/
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS Identity and Access Management Account Takeover
|
||||
asset_type: AWS Account
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Cloud Data
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail.json
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
|
||||
mitre_attack_id:
|
||||
- T1078.004
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: user_name
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: src
|
||||
type: IP Address
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- src
|
||||
- eventName
|
||||
- eventSource
|
||||
- aws_account_id
|
||||
- errorCode
|
||||
- additionalEventData.MFAUsed
|
||||
- userAgent
|
||||
- eventID
|
||||
- awsRegion
|
||||
- user_name
|
||||
- userIdentity.arn
|
||||
risk_score: 64
|
||||
security_domain: threat
|
||||
@@ -0,0 +1,13 @@
|
||||
name: AWS Console Login Failed During MFA Challenge Unit Test
|
||||
tests:
|
||||
- name: AWS Console Login Failed During MFA Challenge
|
||||
file: cloud/aws_console_login_failed_during_mfa_challenge.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: cloudtrail.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json
|
||||
sourcetype: aws:cloudtrail
|
||||
source: aws_cloudtrail
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: AWS Multi-Factor Authentication Disabled Unit Test
|
||||
tests:
|
||||
- name: AWS Multi-Factor Authentication Disabled
|
||||
file: cloud/aws_multi_factor_authentication_disabled.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: cloudtrail.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail.json
|
||||
sourcetype: aws:cloudtrail
|
||||
source: aws_cloudtrail
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: AWS Multiple Failed MFA Requests For User Unit Test
|
||||
tests:
|
||||
- name: AWS Multiple Failed MFA Requests For User
|
||||
file: cloud/aws_multiple_failed_mfa_requests_for_user.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: cloudtrail.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json
|
||||
sourcetype: aws:cloudtrail
|
||||
source: aws_cloudtrail
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,15 @@
|
||||
name: AWS Successful Single-Factor Authentication Unit Test
|
||||
tests:
|
||||
- name: AWS Successful Single-Factor Authentication
|
||||
file: cloud/aws_successful_single_factor_authentication.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: cloudtrail.json
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail.json
|
||||
sourcetype: aws:cloudtrail
|
||||
source: aws_cloudtrail
|
||||
update_timestamp: true
|
||||
|
||||
|
||||
Reference in New Issue
Block a user