From e96a91aeb4de446c7755f6ec4aa524d3b4e2e9e5 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Tue, 16 Jun 2020 12:43:48 -0600 Subject: [PATCH] removed searches that depend on non-extracted fields --- ...y_seen_aws_cross_account_activity___dm.yml | 18 --------- ...ty_from_previously_unseen_account___dm.yml | 40 ------------------- 2 files changed, 58 deletions(-) delete mode 100644 baselines/previously_seen_aws_cross_account_activity___dm.yml delete mode 100644 detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml diff --git a/baselines/previously_seen_aws_cross_account_activity___dm.yml b/baselines/previously_seen_aws_cross_account_activity___dm.yml deleted file mode 100644 index 0ae8731d5b..0000000000 --- a/baselines/previously_seen_aws_cross_account_activity___dm.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: Previously Seen AWS Cross Account Activity - DM -id: 0de7ce99-ab0a-41fe-9624-345df83f08cc -version: 1 -date: '2020-05-28' -description: This datamodel search looks for **AssumeRole** events where the requesting account - differs from the requested account, then writes these relationships to a lookup - file. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) - and Enterprise Security 6.2, which contains the required updates to the Authentication data model - for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, - a lookup file created by this support search. -author: Rico Valdez, Splunk -search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity" -tags: - analytics_story: - - Suspicious Cloud Authentication Activities - detections: - - AWS Cross Account Activity From Previously Unseen Account - DM diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml deleted file mode 100644 index 1da59e4f2f..0000000000 --- a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: AWS Cross Account Activity From Previously Unseen Account - DM -id: 21193641-cb96-4a2c-a707-d9b9a7f7792b -version: 1 -date: '2020-05-28' -description: This search looks for AssumeRole events where an IAM role in a different - account is requested for the first time. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) - and Enterprise Security 6.2, which contains the required updates to the Authentication data model - for cloud use cases. Run the `Previously Seen AWS Cross Account Activity - DM` support search only - once to create the baseline of previously seen cross account activity. -type: ESCU -references: [] -author: Rico Valdez, Splunk -search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src - Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where 'Authentication.vendor_account'!='dest_account' | rename Authentication.vendor_account as - requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity - requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest - | eval firstTime=(if (firstTime>earliest, earliest,firstTime)) | multireport [| table requestingAccountId, - requestedAccountId, firstTime, lastTime | outputlookup previously_seen_aws_cross_account_activity | where fact=fiction] - [| where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_previously_unseen_account___dm_filter` - | rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId, - requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime" -known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior. - It's suspicious when an account requests privileges of an account it hasn't before. - You should validate with the account owner that this is a legitimate request. -tags: - analytics_story: - - Suspicious Cloud Authentication Activities - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 16 - nist: - - PR.AC - - PR.DS - - DE.AE - security_domain: network - asset_type: AWS Instance