From d7bb41378e7fb8fb22fbe391ea91310c8d71bf91 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 23 Jun 2020 15:58:11 -0400 Subject: [PATCH] awssentobj --- ...etes_aws_detect_sensitive_object_access.yml | 18 ++++++++++++++++++ ...etes_aws_detect_sensitive_object_access.yml | 3 +++ 2 files changed, 21 insertions(+) create mode 100644 detections/kubernetes_aws_detect_sensitive_object_access.yml create mode 100644 macros/kubernetes_aws_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_aws_detect_sensitive_object_access.yml b/detections/kubernetes_aws_detect_sensitive_object_access.yml new file mode 100644 index 0000000000..0b4e6f1e18 --- /dev/null +++ b/detections/kubernetes_aws_detect_sensitive_object_access.yml @@ -0,0 +1,18 @@ +author: "Rod Soto, Splunk" +date: "2020-06-23" +description: "This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets" +how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs." +id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c +known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection." +name: "AWS EKS Kubernetes cluster sensitive object access detection" +references: [] +search: sourcetype="aws:cloudwatchlogs:eks" objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 |table sourceIPs{} user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_object_access`" +tags: + analytics_story: + - "Kubernetes Sensitive Object Access Activity" + asset_type: "AWS EKS Kubernetes cluster" + kill_chain_phases: + - Lateral Movement + security_domain: threat +type: ESCU +version: 1 diff --git a/macros/kubernetes_aws_detect_sensitive_object_access.yml b/macros/kubernetes_aws_detect_sensitive_object_access.yml new file mode 100644 index 0000000000..b6589f0b73 --- /dev/null +++ b/macros/kubernetes_aws_detect_sensitive_object_access.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters +name: kubernetes_aws_detect_sensitive_object_access