From 33b5987f160c5204df433118ae999f5d342787db Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 3 Mar 2022 12:46:44 -0800 Subject: [PATCH 1/4] spl updates --- detections/cloud/aws_createaccesskey.yml | 18 ++++++++++++------ detections/cloud/aws_updateloginprofile.yml | 20 +++++++++++++------- 2 files changed, 25 insertions(+), 13 deletions(-) diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 5c2276390f..b3cb80897d 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -1,7 +1,7 @@ name: AWS CreateAccessKey id: 2a9b80d3-6340-4345-11ad-212bf3d0d111 -version: 2 -date: '2021-07-19' +version: 3 +date: '2022-03-03' author: Bhavin Patel, Splunk type: Hunting datamodel: [] @@ -10,10 +10,16 @@ description: This search looks for AWS CloudTrail events where a user A who has user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com - errorCode = success| search userIdentity.userName!=requestParameters.userName | stats - count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName - src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId - user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`' + errorCode = success +| eval match=if(match(userIdentity.userName,requestParameters.userName),0,1) +| search match=0 +| stats + count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName + src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId + user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +|`aws_createaccesskey_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 0c7fd9c7b2..85c4b772b2 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -1,7 +1,7 @@ name: AWS UpdateLoginProfile id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111 -version: 2 -date: '2021-07-19' +version: 3 +date: '2022-03-03' author: Bhavin Patel, Splunk type: TTP datamodel: [] @@ -9,11 +9,17 @@ description: This search looks for AWS CloudTrail events where a user A who has permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com - errorCode = success| search userIdentity.userName!=requestParameters.userName | stats - count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName - src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName - user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`' +search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com + errorCode = success +| eval match=if(match(userIdentity.userName,requestParameters.userName),0,1) +| search match=0 +| stats + count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName + src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName + user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_updateloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible From e53e25aee4aa39ba8841eee66c1bb11828fee012 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Mar 2022 09:23:58 -0800 Subject: [PATCH 2/4] Update aws_createaccesskey.yml --- detections/cloud/aws_createaccesskey.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index b3cb80897d..5b92251523 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events where a user A who has in case new victim(user B) has more permissions than old victim(user B) search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success -| eval match=if(match(userIdentity.userName,requestParameters.userName),0,1) +| eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName From f79866dca4084cb71b5e22bdadf93ebbcaf267e5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 8 Mar 2022 09:24:18 -0800 Subject: [PATCH 3/4] Update aws_updateloginprofile.yml --- detections/cloud/aws_updateloginprofile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 85c4b772b2..f631278fd9 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events where a user A who has in case new victim(user B) has more permissions than old victim(user B) search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success -| eval match=if(match(userIdentity.userName,requestParameters.userName),0,1) +| eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName From e08e7f3e5a17c566bd3b4c9d0c08cbb98f774a9d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 10 Mar 2022 08:16:21 -0700 Subject: [PATCH 4/4] syntax --- detections/cloud/aws_createaccesskey.yml | 15 +++++++-------- detections/cloud/aws_updateloginprofile.yml | 21 ++++++++++----------- 2 files changed, 17 insertions(+), 19 deletions(-) diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 5b92251523..b0a79677d4 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -9,17 +9,16 @@ description: This search looks for AWS CloudTrail events where a user A who has permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com - errorCode = success -| eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) -| search match=0 -| stats +search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success + | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) + | search match=0 + | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -|`aws_createaccesskey_filter`' + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |`aws_createaccesskey_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index f631278fd9..bb8525ded2 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -9,17 +9,16 @@ description: This search looks for AWS CloudTrail events where a user A who has permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com - errorCode = success -| eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) -| search match=0 -| stats - count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName - src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName - user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_updateloginprofile_filter`' +search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success + | eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) + | search match=0 + | stats + count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName + src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName + user_arn + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_updateloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible