From bbc913faaa34e89db5e871171a02a7e827fe1ca8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 19 Nov 2021 11:16:11 -0800 Subject: [PATCH] first 3 detections --- .../cloud/detect_aws_console_login_by_user_from_new_city.yml | 2 +- .../cloud/detect_aws_console_login_by_user_from_new_country.yml | 2 +- .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index e4cc5ea1a1..2cfcd78cd9 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user + | stats min(firstTime) AS earliestseen by user City | fields earliestseen user City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index e0de730c05..0b1236d9f1 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen + | stats min(firstTime) AS earliestseen by user Country | fields earliestseen user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 806537ad99..0d9af9a4bd 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen + | stats min(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New