admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updates

Browse Source
This commit is contained in:
David Dorsey
2020-09-03 00:32:36 -05:00
parent 0b9dd4ca9b
commit ffbd700110
3 changed files with 13 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud_compute_instance_created_by_previously_unseen_user.yml
+11 -10
View File
@@ -1,25 +1,25 @@
name: Cloud Compute Instance Created By Previously Unseen User
id: 76988f6a-3935-48f6-a9e5-6fca8b3ed843
version: 2
date: '2020-07-21'
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
version: 1
date: '2020-08-21'
description: This search looks for cloud compute instances created by users who have
not created them before.
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
XXXXhow_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
and have the Security Research cloud data model (https://github.com/splunk/cloud-datamodel-security-research/)
installed. Run the "Previously Seen Cloud Compute Creations By User" support search
to create of baseline of previously seen users.
type: ESCU
references: []
author: David Dorsey, Splunk
author: Rico Valdez, Splunk
search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time)
as lastTime values(Compute.dest) as dest from datamodel=Cloud_Infrastructure.Compute
where Compute.action=run by Compute.src_user | `drop_dm_object_name("Compute")`
as lastTime values(All_Changes.object) as instance from datamodel=Change
where All_Changes.action=created by All_Changes.user | `drop_dm_object_name("Change")`
| inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats
min(firstTime) as firstTime max(lastTime) as lastTime, values(dest) as dest by src_user
| multireport [| table src_user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user
min(firstTime) as firstTime max(lastTime) as lastTime, values(object) as object by user
| multireport [| table user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user
| where fact=fiction][| eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`),
1, 0) | where new_user=1 | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`]
| table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
| table user, object, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
known_false_positives: It's possible that a user will start to create compute instances
for the first time, for any number of reasons. Verify with the user launching instances
that this is the intended behavior.
@@ -34,3 +34,4 @@ tags:
- ID.AM
security_domain: endpoint
asset_type: Cloud Compute Instance
detections/ec2_instance_modified_with_previously_unseen_user___dm.yml
+1 -1
View File
@@ -4,7 +4,7 @@ version: 1
date: '2020-07-29'
description: This search looks for EC2 instances being modified by users who have
not previously modified them.
###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Launches By
User" support search once to create a history of previously seen ARNs. To add or
detections/ec2_instance_started_with_previously_unseen_user___DM.yml
+1 -11
View File
@@ -4,7 +4,7 @@ version: 1
date: '2020-07-29'
description: This search looks for EC2 instances being created by users who have not
created them before.
##how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Launches By
User" support search once to create a history of previously seen ARNs.
@@ -13,16 +13,6 @@ references: []
author: Rico Valdez, Splunk
###search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime
by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup
previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(),
"-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType
as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) as lastTime
values(All_Changes.object) as Objects from datamodel=Change.All_Changes where All_Changes.action=modified
by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t