From fb00fffd3f58ea7b2d152ea4bc21f2dc23e8acce Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Tue, 18 Aug 2020 17:01:29 -0600 Subject: [PATCH] work in progress file --- ...visioning_from_previously_unseen_country___dm.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_country___dm.yml b/detections/aws_cloud_provisioning_from_previously_unseen_country___dm.yml index 7f4aefda7e..32bca3e098 100644 --- a/detections/aws_cloud_provisioning_from_previously_unseen_country___dm.yml +++ b/detections/aws_cloud_provisioning_from_previously_unseen_country___dm.yml @@ -25,6 +25,18 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`' +search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run* + OR eventName=Create*) | iplocation sourceIPAddress | search Country=* | stats earliest(_time) + as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country + | inputlookup append=t previously_seen_provisioning_activity_src.csv | stats min(firstTime) + as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country + | outputlookup previously_seen_provisioning_activity_src.csv | stats min(firstTime) + as firstTime max(lastTime) as lastTime by sourceIPAddress | eval newIP=if(firstTime + >= relative_time(now(), "-70m@m"), 1, 0) | where newIP=1 | table sourceIPAddress] + | spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table + _time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`' + + search: '| tstats min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) from datmodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.object_category=instance by All_Changes.src