admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-11-08 13:29:18 -08:00
committed by GitHub
parent 7df1b008e9 243b9585ce
commit da33af105f
30 changed files with 78 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
+3
View File
@@ -36,7 +36,10 @@ tags:
- Exploitation
message: User $user_name$ failed to pass MFA challenge while logging into console from $src$
mitre_attack_id:
- T1586
- T1586.003
- T1621
nist:
- DE.CM
observable:
detections/cloud/aws_credential_access_failed_login.yml
+3
View File
@@ -31,6 +31,9 @@ tags:
- Exploitation
message: User $user$ has a login failure from IP $src$
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.001
nist:
- DE.CM
detections/cloud/aws_credential_access_getpassworddata.yml
+4 -1
View File
@@ -31,7 +31,10 @@ tags:
- Exploitation
message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$
mitre_attack_id:
- T1552
- T1586
- T1586.003
- T1110
- T1110.001
nist:
- DE.CM
observable:
detections/cloud/aws_credential_access_rds_password_reset.yml
+3 -1
View File
@@ -33,7 +33,9 @@ tags:
- Exploitation
message: $DB$ password has been reset from IP $sourceIPAddress$
mitre_attack_id:
- T1110.002
- T1586
- T1586.003
- T1110
nist:
- DE.CM
observable:
detections/cloud/aws_multi_factor_authentication_disabled.yml
+4
View File
@@ -37,7 +37,11 @@ tags:
- Exploitation
message: User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$
mitre_attack_id:
- T1586
- T1586.003
- T1621
- T1556
- T1556.006
nist:
- DE.CM
observable:
detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
+2
View File
@@ -34,6 +34,8 @@ tags:
- Exploitation
message: User $user_name$ is seen to have high number of MFA prompt failures within a short period of time.
mitre_attack_id:
- T1586
- T1586.003
- T1621
nist:
- DE.CM
detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
+4 -3
View File
@@ -4,8 +4,7 @@ version: 1
date: '2022-09-27'
author: Bhavin Patel
type: Anomaly
datamodel:
- Endpoint
datamodel: []
description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges.
search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
@@ -35,7 +34,9 @@ tags:
- Exploitation
message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
mitre_attack_id:
- T1003.002
- T1110
- T1110.003
- T1110.004
nist:
- DE.CM
observable:
detections/cloud/aws_successful_single_factor_authentication.yml
+3
View File
@@ -33,6 +33,9 @@ tags:
- Exploitation
message: User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
mitre_attack_id:
- T1586
- T1586.003
- T1078
- T1078.004
nist:
- DE.CM
detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
+5 -1
View File
@@ -39,7 +39,11 @@ tags:
- Exploitation
message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
mitre_attack_id:
- T1003.002
- T1586
- T1586.003
- T1110
- T1110.003
- T1110.004
nist:
- DE.CM
observable:
detections/cloud/azure_active_directory_high_risk_sign_in.yml
+2
View File
@@ -38,6 +38,8 @@ tags:
- Exploitation
message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.003
nist:
detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
- Exploitation
message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
mitre_attack_id:
- T1586
- T1586.003
- T1078
- T1078.004
- T1621
detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
+3
View File
@@ -44,7 +44,10 @@ tags:
- Actions on Objectives
message: MFA disabled for User $userPrincipalName$ initiated by $initiatedBy$
mitre_attack_id:
- T1586
- T1586.003
- T1556
- T1556.006
nist:
- DE.CM
observable:
detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
+2
View File
@@ -45,6 +45,8 @@ tags:
- Exploitation
message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$
mitre_attack_id:
- T1586
- T1586.003
- T1621
- T1078
- T1078.004
detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+2
View File
@@ -45,6 +45,8 @@ tags:
- Exploitation
message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes.
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.003
nist:
detections/cloud/azure_ad_successful_powershell_authentication.yml
+2
View File
@@ -39,6 +39,8 @@ tags:
- Exploitation
message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell.
mitre_attack_id:
- T1586
- T1586.003
- T1078
- T1078.004
nist:
detections/cloud/azure_ad_successful_single_factor_authentication.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
- Exploitation
message: Successful authentication for user $body.properties.userPrincipalName$ without MFA
mitre_attack_id:
- T1586
- T1586.003
- T1078
- T1078.004
nist:
detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+3
View File
@@ -53,8 +53,11 @@ tags:
- Exploitation
message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.003
- T1110.004
nist:
- DE.CM
observable:
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+2
View File
@@ -62,6 +62,8 @@ tags:
message: User $user$ is logging into the AWS console from City $City$ for the first
time
mitre_attack_id:
- T1586
- T1586.003
- T1535
nist:
- DE.DP
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+2
View File
@@ -63,6 +63,8 @@ tags:
message: User $user$ is logging into the AWS console from Country $Country$ for
the first time
mitre_attack_id:
- T1586
- T1586.003
- T1535
nist:
- DE.DP
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+2
View File
@@ -62,6 +62,8 @@ tags:
message: User $user$ is logging into the AWS console from Region $Region$ for the
first time
mitre_attack_id:
- T1586
- T1586.003
- T1535
nist:
- DE.DP
detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
- Exploitation
message: User $user$ failed to pass MFA challenge
mitre_attack_id:
- T1586
- T1586.003
- T1078
- T1078.004
- T1621
detections/cloud/gcp_multi_factor_authentication_disabled.yml
+2
View File
@@ -39,6 +39,8 @@ tags:
- Actions on Objectives
message: MFA disabled for User $user$ initiated by $actor.email$
mitre_attack_id:
- T1586
- T1586.003
- T1556
nist:
- DE.CM
detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
+2
View File
@@ -43,6 +43,8 @@ tags:
- Exploitation
message: Multiple Failed MFA requests for user $user$
mitre_attack_id:
- T1586
- T1586.003
- T1621
- T1078
- T1078.004
detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
+4
View File
@@ -35,7 +35,11 @@ tags:
- Exploitation
message: Multiple failed login attempts against users $tried_accounts$ seen from $src_ip$
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.003
- T1110.004
nist:
- DE.CM
observable:
detections/cloud/gcp_successful_single_factor_authentication.yml
+2
View File
@@ -36,6 +36,8 @@ tags:
- Exploitation
message: Successful authentication for user $user$ without MFA
mitre_attack_id:
- T1586
- T1586.003
- T1078
- T1078.004
nist:
detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
+4
View File
@@ -39,7 +39,11 @@ tags:
- Exploitation
message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.003
- T1110.004
nist:
- DE.CM
observable:
detections/endpoint/rubeus_command_line_parameters.yml
+1 -1
View File
@@ -17,7 +17,7 @@ description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It
this analytic.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
OR Processes.process = "* monitor *" OR Processes.process ="* asktgt* /user:*" OR
OR Processes.process = "* monitor /interval*" OR Processes.process ="* asktgt* /user:*" OR
Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*"
OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*"
OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*"
detections/cloud/detect_aws_console_login_by_new_user.yml → detections/experimental/cloud/detect_aws_console_login_by_new_user.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
cis20:
- CIS 16
mitre_attack_id:
- T1586
- T1586.003
- T1552
confidence: 60
context:
requirements.txt
+4 -4
View File
@@ -1,13 +1,13 @@
attackcti==0.3.7
docker==6.0.0
GitPython==3.1.27
GitPython==3.1.29
Jinja2==3.1.2
jsonschema==4.16.0
jsonschema==4.17.0
mock==4.0.3
psutil==5.9.2
psutil==5.9.3
pycvesearch==1.2
pydantic==1.10.2
pytest==7.1.3
pytest==7.2.0
PyYAML==5.4.1
questionary==1.10.0
requests==2.28.1
tests/cloud/detect_aws_console_login_by_new_user.test.yml → tests/experimental/cloud/detect_aws_console_login_by_new_user.test.yml
View File