Merge pull request #1520 from splunk/cloud_rab2

Cloud RBA - 2

bin/validate.py

@@ -177,7 +177,6 @@ def validate_standard_fields(object, uuids):
             calculated_risk_score = int(((object['tags']['impact'])*(object['tags']['confidence']))/100)
             if calculated_risk_score != object['tags']['risk_score']:
                 errors.append("ERROR: risk_score not calulated correctly and it should be set to %s for " % calculated_risk_score + object['name'])
-
     return errors, uuids
 
 

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -51,7 +51,20 @@ tags:
   - All_Changes.status
   - All_Changes.command
   - All_Changes.object
-  risk_object: user
-  risk_object_type: user
-  risk_score: 25
-  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Recon
+  - Stage:Execution
+  message: User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before
+  observable:
+  - name: user
+    type: user
+    role:
+    - Attacker
+  security_domain: threat

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -1,7 +1,7 @@
 name: Cloud Compute Instance Created By Previously Unseen User
 id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
-version: 1
-date: '2020-08-21'
+version: 2
+date: '2021-07-13'
 author: Rico Valdez, Splunk
 type: batch
 datamodel:
@@ -48,7 +48,24 @@ tags:
   - All_Changes.action
   - All_Changes.user
   - All_Changes.vendor_region
-  risk_object: user
-  risk_object_type: user
-  risk_score: 20
-  security_domain: endpoint
+  impact: 30
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 18
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Recon
+  - Stage:Execution
+  message: User $user$ is creating a new instance $dest$ for the first time 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -54,7 +54,23 @@ tags:
   - All_Changes.action
   - All_Changes.vendor_region
   - All_Changes.user
-  risk_object: user
-  risk_object_type: user
-  risk_score: 20
-  security_domain: network
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is creating an instance $dest$ in a new region for the first time 
+  observable:
+  - name: user
+    type: user
+    role:
+    - Attacker
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -49,7 +49,23 @@ tags:
   - All_Changes.action
   - All_Changes.Instance_Changes.image_id
   - All_Changes.user
-  risk_object: user
-  risk_object_type: user
-  risk_score: 20
-  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is creating an instance $dest$ with an image that has not been previously seen. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -49,7 +49,24 @@ tags:
   - All_Changes.action
   - All_Changes.Instance_Changes.instance_type
   - All_Changes.user
-  risk_object: user
-  risk_object_type: user
-  risk_score: 20
-  security_domain: endpoint
+  impact: 50
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 30
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -51,7 +51,23 @@ tags:
   - All_Changes.change_type
   - All_Changes.status
   - All_Changes.user
-  risk_object: user
-  risk_object_type: user
-  risk_score: 10
-  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is modifying an instance $dest$ for the first time. 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -66,7 +66,27 @@ tags:
   - All_Changes.user
   - All_Changes.object
   - All_Changes.command
-  risk_object: user
-  risk_object_type: user
-  risk_score: 10
-  security_domain: endpoint
+  impact: 30
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 18
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -66,7 +66,27 @@ tags:
   - All_Changes.user
   - All_Changes.object
   - All_Changes.command
-  risk_object: user
-  risk_object_type: user
-  risk_score: 5
-  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: object
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -65,7 +65,27 @@ tags:
   - All_Changes.src
   - All_Changes.user
   - All_Changes.command
-  risk_object: user
-  risk_object_type: user
-  risk_score: 5
-  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: object_id
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -66,7 +66,27 @@ tags:
   - All_Changes.user
   - All_Changes.object
   - All_Changes.command
-  risk_object: user
-  risk_object_type: user
-  risk_score: 5
-  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: object
+    type: Endpoint
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -52,7 +52,19 @@ tags:
   - _time
   - Authentication.signature
   - Authentication.user
-  risk_object: user
-  risk_object_type: user
+  impact: 50
+  confidence: 60
+  # (impact * confidence)/100
   risk_score: 30
-  security_domain: network
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is logging into the AWS console for the first time
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  security_domain: threat

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -61,7 +61,19 @@ tags:
   - Authentication.signature
   - Authentication.user
   - Authentication.src
-  risk_object: user
-  risk_object_type: user
-  risk_score: 5
-  security_domain: network
+  impact: 30
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 18
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is logging into the AWS console from City $City$ for the first time
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  security_domain: threat

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -61,7 +61,19 @@ tags:
   - Authentication.signature
   - Authentication.user
   - Authentication.src
-  risk_object: user
-  risk_object_type: user
-  risk_score: 5
-  security_domain: network
+  impact: 70
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is logging into the AWS console from Country $Country$ for the first time
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  security_domain: threat

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -61,7 +61,19 @@ tags:
   - Authentication.signature
   - Authentication.user
   - Authentication.src
-  risk_object: user
-  risk_object_type: user
-  risk_score: 5
-  security_domain: network
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ is logging into the AWS console from Region $Region$ for the first time
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  security_domain: threat

detections/cloud/detect_new_open_s3_buckets.yml

@@ -54,7 +54,23 @@ tags:
   - userAgent
   - uri
   - permission
-  risk_object: src
-  risk_object_type: system
-  risk_score: 20
-  security_domain: network
+  impact: 60
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 48
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$
+  observable:
+  - name: userName
+    type: User
+    role:
+    - Attacker
+  - name: bucketName
+    type: Other
+    role:
+    - Victim
+  security_domain: threat

detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml

@@ -58,7 +58,23 @@ tags:
   - userIdentity.principalId
   - userAgent
   - bucketName
-  risk_object: src
-  risk_object_type: system
-  risk_score: 20
-  security_domain: network
+  impact: 60
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 48
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  message: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
+  observable:
+  - name: userName
+    type: User
+    role:
+    - Attacker
+  - name: bucketName
+    type: Other
+    role:
+    - Victim
+  security_domain: threat