From d6a32d4bd53128c19dc019013b8e25661738dcd3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 18:47:13 +0000 Subject: [PATCH] Added detection testing service results inAWS IAM AccessDenied Discovery Events --- .../aws_iam_accessdenied_discovery_events.yml | 29 ++++++++++++------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index d8b8657e4e..30a6a756f6 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -5,22 +5,28 @@ date: '2021-04-05' author: Michael Haag, Splunk type: batch datamodel: [] -description: The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated. +description: The following detection identifies excessive AccessDenied events within + an hour timeframe. It is possible that an access key to AWS may have been stolen + and is being misused to perform discovery events. In these instances, the access + is not available with the key stolen therefore these events will be generated. search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) - | bucket _time span=1h - | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time - | where failures >= 5 and methods >= 1 and sources >= 1 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) + as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) + by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources + >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives. +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible to start this detection will need to be tuned + by source IP or user. In addition, change the count values to an upper threshold + to restrict false positives. references: - - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ +- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json kill_chain_phases: - Reconnaissance mitre_attack_id: @@ -37,4 +43,5 @@ tags: - userAgent - errorCode - userIdentity.type - security_domain: access \ No newline at end of file + security_domain: access + automated_detection_testing: passed