From ffbd70011018bd8270ae2ca730f7c9bd2e96ba00 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Thu, 3 Sep 2020 00:32:36 -0500 Subject: [PATCH] Updates --- ...ance_created_by_previously_unseen_user.yml | 21 ++++++++++--------- ...ified_with_previously_unseen_user___dm.yml | 2 +- ...arted_with_previously_unseen_user___DM.yml | 12 +---------- 3 files changed, 13 insertions(+), 22 deletions(-) diff --git a/detections/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud_compute_instance_created_by_previously_unseen_user.yml index 4203bdee6d..fdce95df9a 100644 --- a/detections/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,25 +1,25 @@ name: Cloud Compute Instance Created By Previously Unseen User -id: 76988f6a-3935-48f6-a9e5-6fca8b3ed843 -version: 2 -date: '2020-07-21' +id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 +version: 1 +date: '2020-08-21' description: This search looks for cloud compute instances created by users who have not created them before. -how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs +XXXXhow_to_implement: You must be ingesting the appropriate cloud-infrastructure logs and have the Security Research cloud data model (https://github.com/splunk/cloud-datamodel-security-research/) installed. Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users. type: ESCU references: [] -author: David Dorsey, Splunk +author: Rico Valdez, Splunk search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) - as lastTime values(Compute.dest) as dest from datamodel=Cloud_Infrastructure.Compute - where Compute.action=run by Compute.src_user | `drop_dm_object_name("Compute")` + as lastTime values(All_Changes.object) as instance from datamodel=Change + where All_Changes.action=created by All_Changes.user | `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats - min(firstTime) as firstTime max(lastTime) as lastTime, values(dest) as dest by src_user - | multireport [| table src_user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user + min(firstTime) as firstTime max(lastTime) as lastTime, values(object) as object by user + | multireport [| table user, firstTime, lastTime | outputlookup previously_seen_cloud_compute_creations_by_user | where fact=fiction][| eval new_user=if(firstTime >= relative_time(now(), `previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), 1, 0) | where new_user=1 | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`] - | table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`' + | table user, object, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`' known_false_positives: It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior. @@ -34,3 +34,4 @@ tags: - ID.AM security_domain: endpoint asset_type: Cloud Compute Instance + diff --git a/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml b/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml index dc7717332e..a9ddb8fb26 100644 --- a/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml +++ b/detections/ec2_instance_modified_with_previously_unseen_user___dm.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-07-29' description: This search looks for EC2 instances being modified by users who have not previously modified them. -###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or diff --git a/detections/ec2_instance_started_with_previously_unseen_user___DM.yml b/detections/ec2_instance_started_with_previously_unseen_user___DM.yml index 36b99921f3..6c7fa5ba1a 100644 --- a/detections/ec2_instance_started_with_previously_unseen_user___DM.yml +++ b/detections/ec2_instance_started_with_previously_unseen_user___DM.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-07-29' description: This search looks for EC2 instances being created by users who have not created them before. -##how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. @@ -13,16 +13,6 @@ references: [] author: Rico Valdez, Splunk -###search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances - errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime - by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv - | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup - previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(), - "-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType - as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn - as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`' - search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as Objects from datamodel=Change.All_Changes where All_Changes.action=modified by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t