admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-14 10:14:20 -07:00
committed by GitHub
parent 6302da697e 3315565add
commit ea50d6add6
2 changed files with 23 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_createaccesskey.yml
+12 -7
View File
@@ -1,7 +1,7 @@
name: AWS CreateAccessKey
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
version: 2
date: '2021-07-19'
version: 3
date: '2022-03-03'
author: Bhavin Patel, Splunk
type: Hunting
datamodel: []
@@ -9,11 +9,16 @@ description: This search looks for AWS CloudTrail events where a user A who has
permission to create access keys, makes an API call to create access keys for another
user B. Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com
errorCode = success| search userIdentity.userName!=requestParameters.userName | stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`'
search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success
| eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
| search match=0
| stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
user_arn
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|`aws_createaccesskey_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
detections/cloud/aws_updateloginprofile.yml
+11 -6
View File
@@ -1,7 +1,7 @@
name: AWS UpdateLoginProfile
id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
version: 2
date: '2021-07-19'
version: 3
date: '2022-03-03'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
@@ -9,11 +9,16 @@ description: This search looks for AWS CloudTrail events where a user A who has
permission to update login profile, makes an API call to update login profile for
another user B . Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
errorCode = success| search userIdentity.userName!=requestParameters.userName | stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success
| eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0)
| search match=0
| stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName
user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`'
user_arn
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_updateloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible