admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAWS Network Access Control List Deleted

Browse Source
This commit is contained in:
root
2021-01-12 10:33:02 +00:00
parent e1e595c654
commit fd58b28807
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_network_access_control_list_deleted.yml
+6 -3
View File
@@ -14,8 +14,9 @@ type: ESCU
references: []
author: Bhavin Patel, Patrick Bareiss, Splunk
search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
known_false_positives: It's possible that a user has legitimately deleted a network
ACL.
tags:
@@ -35,4 +36,6 @@ tags:
risk_score: 5
risk_object_type: user
risk_object: userName
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json