diff --git a/bin/validate.py b/bin/validate.py index eac324e8a8..33ec682096 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -177,7 +177,6 @@ def validate_standard_fields(object, uuids): calculated_risk_score = int(((object['tags']['impact'])*(object['tags']['confidence']))/100) if calculated_risk_score != object['tags']['risk_score']: errors.append("ERROR: risk_score not calulated correctly and it should be set to %s for " % calculated_risk_score + object['name']) - return errors, uuids diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 6e4aee9e77..7a452f7eee 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -51,7 +51,20 @@ tags: - All_Changes.status - All_Changes.command - All_Changes.object - risk_object: user - risk_object_type: user - risk_score: 25 - security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Recon + - Stage:Execution + message: User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before + observable: + - name: user + type: user + role: + - Attacker + security_domain: threat diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 6d8f20e18d..70990ec77f 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,7 +1,7 @@ name: Cloud Compute Instance Created By Previously Unseen User id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -version: 1 -date: '2020-08-21' +version: 2 +date: '2021-07-13' author: Rico Valdez, Splunk type: batch datamodel: @@ -48,7 +48,24 @@ tags: - All_Changes.action - All_Changes.user - All_Changes.vendor_region - risk_object: user - risk_object_type: user - risk_score: 20 - security_domain: endpoint + impact: 30 + confidence: 60 + # (impact * confidence)/100 + risk_score: 18 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Recon + - Stage:Execution + message: User $user$ is creating a new instance $dest$ for the first time + observable: + - name: user + type: User + role: + - Attacker + - name: dest + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 5181900d57..670addb3b1 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -54,7 +54,23 @@ tags: - All_Changes.action - All_Changes.vendor_region - All_Changes.user - risk_object: user - risk_object_type: user - risk_score: 20 - security_domain: network + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is creating an instance $dest$ in a new region for the first time + observable: + - name: user + type: user + role: + - Attacker + - name: dest + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 068b7651d9..30b44ec8c6 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -49,7 +49,23 @@ tags: - All_Changes.action - All_Changes.Instance_Changes.image_id - All_Changes.user - risk_object: user - risk_object_type: user - risk_score: 20 - security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is creating an instance $dest$ with an image that has not been previously seen. + observable: + - name: user + type: User + role: + - Attacker + - name: dest + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 30e8096950..fbfe98862e 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -49,7 +49,24 @@ tags: - All_Changes.action - All_Changes.Instance_Changes.instance_type - All_Changes.user - risk_object: user - risk_object_type: user - risk_score: 20 - security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. + observable: + - name: user + type: User + role: + - Attacker + observable: + - name: dest + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 810320d61c..5f8c0e7590 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -51,7 +51,23 @@ tags: - All_Changes.change_type - All_Changes.status - All_Changes.user - risk_object: user - risk_object_type: user - risk_score: 10 - security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is modifying an instance $dest$ for the first time. + observable: + - name: user + type: User + role: + - Attacker + - name: dest + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index aa1b0b25d6..ad2c97f674 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -66,7 +66,27 @@ tags: - All_Changes.user - All_Changes.object - All_Changes.command - risk_object: user - risk_object_type: user - risk_score: 10 - security_domain: endpoint + impact: 30 + confidence: 60 + # (impact * confidence)/100 + risk_score: 18 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ + observable: + - name: user + type: User + role: + - Attacker + - name: src + type: IP Address + role: + - Attacker + - name: dest + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index daa8caf0d3..d9c3c6cca8 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -66,7 +66,27 @@ tags: - All_Changes.user - All_Changes.object - All_Changes.command - risk_object: user - risk_object_type: user - risk_score: 5 - security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ + observable: + - name: user + type: User + role: + - Attacker + - name: src + type: IP Address + role: + - Attacker + - name: object + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index b96889ae17..5290034a63 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -65,7 +65,27 @@ tags: - All_Changes.src - All_Changes.user - All_Changes.command - risk_object: user - risk_object_type: user - risk_score: 5 - security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ + observable: + - name: user + type: User + role: + - Attacker + - name: src + type: IP Address + role: + - Attacker + - name: object_id + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 41446e109c..13c115d37e 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -66,7 +66,27 @@ tags: - All_Changes.user - All_Changes.object - All_Changes.command - risk_object: user - risk_object_type: user - risk_score: 5 - security_domain: endpoint + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ + observable: + - name: user + type: User + role: + - Attacker + - name: src + type: IP Address + role: + - Attacker + - name: object + type: Endpoint + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index f983c9e690..c2cc21e7db 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -52,7 +52,19 @@ tags: - _time - Authentication.signature - Authentication.user - risk_object: user - risk_object_type: user + impact: 50 + confidence: 60 + # (impact * confidence)/100 risk_score: 30 - security_domain: network + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is logging into the AWS console for the first time + observable: + - name: user + type: User + role: + - Attacker + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 4d97c2485f..defd5cdf87 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -61,7 +61,19 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - risk_object: user - risk_object_type: user - risk_score: 5 - security_domain: network + impact: 30 + confidence: 60 + # (impact * confidence)/100 + risk_score: 18 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is logging into the AWS console from City $City$ for the first time + observable: + - name: user + type: User + role: + - Attacker + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 8aa8cc5f65..8484eb13b3 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -61,7 +61,19 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - risk_object: user - risk_object_type: user - risk_score: 5 - security_domain: network + impact: 70 + confidence: 60 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is logging into the AWS console from Country $Country$ for the first time + observable: + - name: user + type: User + role: + - Attacker + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index e638c488d5..e5b5690b26 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -61,7 +61,19 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - risk_object: user - risk_object_type: user - risk_score: 5 - security_domain: network + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ is logging into the AWS console from Region $Region$ for the first time + observable: + - name: user + type: User + role: + - Attacker + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index c27a34643c..071f2448b1 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -54,7 +54,23 @@ tags: - userAgent - uri - permission - risk_object: src - risk_object_type: system - risk_score: 20 - security_domain: network + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$ + observable: + - name: userName + type: User + role: + - Attacker + - name: bucketName + type: Other + role: + - Victim + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index d84e766b66..c10bcf027f 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -58,7 +58,23 @@ tags: - userIdentity.principalId - userAgent - bucketName - risk_object: src - risk_object_type: system - risk_score: 20 - security_domain: network + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + message: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ + observable: + - name: userName + type: User + role: + - Attacker + - name: bucketName + type: Other + role: + - Victim + security_domain: threat \ No newline at end of file