diff --git a/baselines/previously_seen_aws_cross_account_activity_initial.yml b/baselines/previously_seen_aws_cross_account_activity_initial.yml index 6460b7e917..0adc509f27 100644 --- a/baselines/previously_seen_aws_cross_account_activity_initial.yml +++ b/baselines/previously_seen_aws_cross_account_activity_initial.yml @@ -2,27 +2,12 @@ name: Previously Seen AWS Cross Account Activity - Initial id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf version: 1 date: '2020-08-15' -description: This search looks for **AssumeRole** events where the requesting account - differs from the requested account, then writes these relationships to a lookup - file. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) - and Enterprise Security 6.2, which contains the required updates to the Authentication data model - for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, - a lookup file created by this support search. +description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. author: Rico Valdez, Splunk -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src - Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' - | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId - dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime - | outputlookup previously_seen_aws_cross_account_activity" +search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity" tags: analytics_story: - Suspicious Cloud Authentication Activities detections: - - AWS Cross Account Activity From Previously Unseen Account - DM - - - - - + - AWS Cross Account Activity From Previously Unseen Account - DM \ No newline at end of file diff --git a/baselines/previously_seen_aws_cross_account_activity_update.yml b/baselines/previously_seen_aws_cross_account_activity_update.yml index 823e705843..fdb9e855cf 100644 --- a/baselines/previously_seen_aws_cross_account_activity_update.yml +++ b/baselines/previously_seen_aws_cross_account_activity_update.yml @@ -6,17 +6,11 @@ description: This search looks for **AssumeRole** events where the requesting ac differs from the requested account, then writes these relationships to a lookup file. how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) - and Enterprise Security 6.2, which contains the required updates to the Authentication data model - for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, + and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. author: Rico Valdez, Splunk -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src - Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' - | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId - dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity - | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId - | outputlookup previously_seen_aws_cross_account_activity' +search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication + where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId| outputlookup previously_seen_aws_cross_account_activity" tags: analytics_story: - Suspicious Cloud Authentication Activities diff --git a/baselines/previously_seen_cloud_compute_images_update.yml b/baselines/previously_seen_cloud_compute_images_update.yml index e6fd190e29..41e33d8053 100644 --- a/baselines/previously_seen_cloud_compute_images_update.yml +++ b/baselines/previously_seen_cloud_compute_images_update.yml @@ -10,7 +10,7 @@ author: David Dorsey, Splunk search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.action=created `previously_seen_cloud_compute_image_input_filter` by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTime) as firstTime - max(lastTime) as lastTime by image_id | outputlookup previously_seen_cloud_compute_images + max(lastTime) as lastTime by image_id | outputlookup previously_seen_cloud_compute_images' tags: analytics_story: - Cloud Cryptomining diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user_update.yml b/baselines/previously_seen_cloud_instance_modifications_by_user_update.yml index 41267788e8..81bdacf955 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user_update.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user_update.yml @@ -2,9 +2,8 @@ name: Previously Seen Cloud Instance Modifications By User - Update id: 534b7d30-7b0c-4510-8f55-65439850d58d version: 1 date: '2020-07-29' -###description: This search builds a table of previously seen ARNs that have launched - a EC2 instance. -###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) +description: This search updates a table of previously seen Cloud Instance modifications that have been made by a user +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. author: Rico Valdez, Splunk @@ -18,6 +17,6 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d   | outputlookup previously_seen_cloud_instance_modificationss_by_user | stats count' tags: analytics_story: - - Suspicious Cloud Change Activity - Mustang + - Suspicious Cloud Change Activity detections: - Cloud Instance Modified With Previously Unseen User diff --git a/baselines/previously_seen_ec2_launches_by_user_initial___dm.yml b/baselines/previously_seen_ec2_launches_by_user_initial___dm.yml deleted file mode 100644 index f618f7f181..0000000000 --- a/baselines/previously_seen_ec2_launches_by_user_initial___dm.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Previously Seen EC2 Launches By User - DM -id: 85b5f461-30e1-417b-b6d7-0c2ea5a1fb0c -version: 1 -date: '2020-07-29' -description: This search builds a table of previously seen ARNs that have launched - a EC2 instance. -###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. -author: Rico Valdez, Splunk -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes -  where All_Changes.action=created All_Changes.object_category=instance All_Changes.status=success - `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user -  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user_dm -  | stats count' -tags: - analytics_story: - - Suspicious Cloud Change Activities - detections: - - EC2 Instance Started With Previously Unseen User - DM diff --git a/baselines/previously_seen_ec2_launches_by_user_update___dm.yml b/baselines/previously_seen_ec2_launches_by_user_update___dm.yml deleted file mode 100644 index 5572d2f2b5..0000000000 --- a/baselines/previously_seen_ec2_launches_by_user_update___dm.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Previously Seen EC2 Launches By User - Update - DM -id: 7a6bf377-6c97-41f0-8ba1-fde334aee69c -version: 1 -date: '2020-07-29' -description: This search builds a table of previously seen ARNs that have launched - a EC2 instance. -###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. -author: Rico Valdez, Splunk -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes -  where All_Changes.action=created All_Changes.object_category=instance All_Changes.status=success - `previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user -  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user_dm -  | stats count' - - - - - -search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) as lastTime - values(All_Changes.object) as Objects from datamodel=Change.All_Changes where All_Changes.action=modified - by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t - previously_seen_cloud_compute_creations_by_user | stats min(firstTime) as firstTime max(lastTime) - as lastTime, values(Objects) as Objects by user | multireport [| table user, firstTime, lastTime - | outputlookup previously_seen_cloud_compute_creations_by_user | where fact=fiction] - [| eval new_user=if(firstTime >= relative_time(now(), - `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), 1, 0) | where new_user=1 - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] - | table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`' - - - -###search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances - errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime - by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv - | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup - previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(), - "-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType - as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn - as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`' - - - - -tags: - analytics_story: - - Suspicious Cloud Change Activities - detections: - - EC2 Instance Started With Previously Unseen User - DM diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml index df526456f1..d475e49139 100644 --- a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml +++ b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml @@ -18,9 +18,9 @@ search: "| tstats min(_time) as firstTime max(_time) as lastTime from datamodel= requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_previously_unseen_account_filter` + | `security_content_ctime(lastTime)` | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId, - requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime" + requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime | `aws_cross_account_activity_from_previously_unseen_account___dm_filter`" known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request. diff --git a/detections/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud_compute_instance_created_with_previously_unseen_image.yml index 5f0792b13f..4f17539b0b 100644 --- a/detections/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -15,9 +15,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values as dest from datamodel=Change where All_Changes.action=created `cloud_compute_instance_created_with_previously_unseen_image_filter` by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTime) as firstTime - max(lastTime) as lastTime, values(dest) as dest by image_id, user - - + max(lastTime) as lastTime, values(dest) as dest by image_id, user' known_false_positives: After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user. diff --git a/detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index cada4ba1b8..3be330b8ea 100644 --- a/detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -10,14 +10,12 @@ how_to_implement: You must be ingesting the appropriate cloud-infrastructure log type: ESCU references: [] author: David Dorsey, Splunk - search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTime) as - firstTime max(lastTime) as lastTime, values(dest) as dest by instance_type, user - + firstTime max(lastTime) as lastTime, values(dest) as dest by instance_type, user' known_false_positives: It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.