admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removed searches that depend on non-extracted fields

Browse Source
This commit is contained in:
Rico Valdez
2020-06-16 12:43:48 -06:00
parent 3c8c201add
commit e96a91aeb4
2 changed files with 0 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/previously_seen_aws_cross_account_activity___dm.yml
-18
View File
@@ -1,18 +0,0 @@
name: Previously Seen AWS Cross Account Activity - DM
id: 0de7ce99-ab0a-41fe-9624-345df83f08cc
version: 1
date: '2020-05-28'
description: This datamodel search looks for **AssumeRole** events where the requesting account
differs from the requested account, then writes these relationships to a lookup
file.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
and Enterprise Security 6.2, which contains the required updates to the Authentication data model
for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
a lookup file created by this support search.
author: Rico Valdez, Splunk
search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity"
tags:
analytics_story:
- Suspicious Cloud Authentication Activities
detections:
- AWS Cross Account Activity From Previously Unseen Account - DM
detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml
-40
View File
@@ -1,40 +0,0 @@
name: AWS Cross Account Activity From Previously Unseen Account - DM
id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
version: 1
date: '2020-05-28'
description: This search looks for AssumeRole events where an IAM role in a different
account is requested for the first time.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
and Enterprise Security 6.2, which contains the required updates to the Authentication data model
for cloud use cases. Run the `Previously Seen AWS Cross Account Activity - DM` support search only
once to create the baseline of previously seen cross account activity.
type: ESCU
references: []
author: Rico Valdez, Splunk
search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as
requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity
requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest
| eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | multireport [| table requestingAccountId,
requestedAccountId, firstTime, lastTime | outputlookup previously_seen_aws_cross_account_activity | where fact=fiction]
[| where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_previously_unseen_account___dm_filter`
| rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId,
requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime"
known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
It's suspicious when an account requests privileges of an account it hasn't before.
You should validate with the account owner that this is a legitimate request.
tags:
analytics_story:
- Suspicious Cloud Authentication Activities
kill_chain_phases:
- Actions on Objectives
cis20:
- CIS 16
nist:
- PR.AC
- PR.DS
- DE.AE
security_domain: network
asset_type: AWS Instance