From fd58b2880764b6ea46aaae2aa8203362edd75630 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 12 Jan 2021 10:33:02 +0000 Subject: [PATCH] Added detection testing service results inAWS Network Access Control List Deleted --- .../cloud/aws_network_access_control_list_deleted.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 3ed520b690..40a9a9a53b 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -14,8 +14,9 @@ type: ESCU references: [] author: Bhavin Patel, Patrick Bareiss, Splunk search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false - | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName + userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`' known_false_positives: It's possible that a user has legitimately deleted a network ACL. tags: @@ -35,4 +36,6 @@ tags: risk_score: 5 risk_object_type: user risk_object: userName - + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json