admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAWS IAM AccessDenied Discovery Events

Browse Source
This commit is contained in:
root
2021-04-15 18:47:13 +00:00
parent 453b0accec
commit d6a32d4bd5
1 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_iam_accessdenied_discovery_events.yml
+18 -11
View File
@@ -5,22 +5,28 @@ date: '2021-04-05'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
description: The following detection identifies excessive AccessDenied events within
an hour timeframe. It is possible that an access key to AWS may have been stolen
and is being misused to perform discovery events. In these instances, the access
is not available with the key stolen therefore these events will be generated.
search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
| bucket _time span=1h
| stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time
| where failures >= 5 and methods >= 1 and sources >= 1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time)
as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn)
by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources
>= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_iam_accessdenied_discovery_events_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
known_false_positives: It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
known_false_positives: It is possible to start this detection will need to be tuned
by source IP or user. In addition, change the count values to an upper threshold
to restrict false positives.
references:
- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
tags:
analytic_story:
- AWS IAM Privilege Escalation
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
@@ -37,4 +43,5 @@ tags:
- userAgent
- errorCode
- userIdentity.type
security_domain: access
security_domain: access
automated_detection_testing: passed