mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
2815 lines
243 KiB
Plaintext
2815 lines
243 KiB
Plaintext
#############
|
|
# Automatically generated by generator.py in splunk/security_content
|
|
# On Date: 2021-12-15T02:51:23 UTC
|
|
# Author: Splunk Security Research
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
### ESCU DETECTIONS ###
|
|
|
|
[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
|
|
action.escu.known_false_positives =
|
|
action.escu.creation_date = 2020-09-07
|
|
action.escu.modification_date = 2020-09-07
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
|
|
|
|
[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
|
|
action.escu.known_false_positives =
|
|
action.escu.creation_date = 2020-09-07
|
|
action.escu.modification_date = 2020-09-07
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`
|
|
|
|
[ESCU - AWS Create Policy Version to allow all resources - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
|
|
action.escu.creation_date = 2021-02-22
|
|
action.escu.modification_date = 2021-02-22
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Create Policy Version to allow all resources - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ created a policy version that allows them to access any resource in their account
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Create Policy Version to allow all resources - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | search key_policy_action_1 = "*" | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`
|
|
|
|
[ESCU - AWS CreateAccessKey - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
|
|
action.escu.creation_date = 2021-07-19
|
|
action.escu.modification_date = 2021-07-19
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS CreateAccessKey - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS CreateAccessKey - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 90, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`
|
|
|
|
[ESCU - AWS CreateLoginProfile - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user.
|
|
action.escu.creation_date = 2021-07-19
|
|
action.escu.modification_date = 2021-07-19
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS CreateLoginProfile - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$
|
|
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS CreateLoginProfile - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName | join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename userIdentity.userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`
|
|
|
|
[ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
|
|
action.escu.data_models = ["Authentication"]
|
|
action.escu.eli5 = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
|
|
action.escu.known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
|
|
action.escu.creation_date = 2020-05-28
|
|
action.escu.modification_date = 2020-05-28
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time.
|
|
action.risk.param._risk = [{"threat_object_field": "requestingAccountId", "threat_object_type": "other"}, {"threat_object_field": "requestedAccountId", "threat_object_type": "other"}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"], "observable": [{"name": "requestingAccountId", "role": ["Attacker"], "type": "Other"}, {"name": "requestedAccountId", "role": ["Victim"], "type": "Other"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity requestingAccountId, requestedAccountId, OUTPUTNEW firstTime | eval status = if(firstTime > relative_time(now(), "-24h@h"),"New Cross Account Activity","Previously Seen") | where status = "New Cross Account Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_cross_account_activity_from_previously_unseen_account_filter`
|
|
|
|
[ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company.
|
|
action.escu.mappings = {"mitre_attack": ["T1486"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company.
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
|
|
action.escu.known_false_positives = unknown
|
|
action.escu.creation_date = 2021-01-11
|
|
action.escu.modification_date = 2021-01-11
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Ransomware Cloud"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts.
|
|
action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "mitre_attack": ["T1486"], "observable": [{"name": "userIdentity.principalId", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | spath input=key_policy_statements output=key_policy_action_2 path=Action{} | eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2) | spath input=key_policy_statements output=key_policy_principal path=Principal.AWS | search key_policy_action="kms:Encrypt" AND key_policy_principal="*" | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`
|
|
|
|
[ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets.
|
|
action.escu.mappings = {"mitre_attack": ["T1486"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets.
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
|
|
action.escu.known_false_positives = bucket with S3 encryption
|
|
action.escu.creation_date = 2021-01-11
|
|
action.escu.modification_date = 2021-01-11
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Ransomware Cloud"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"threat_object_field": "dest_file", "threat_object_type": "file"}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1486"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest_file", "role": ["Target"], "type": "File"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`
|
|
|
|
[ESCU - AWS Excessive Security Scanning - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = While this search has no known false positives.
|
|
action.escu.creation_date = 2021-04-13
|
|
action.escu.modification_date = 2021-04-13
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Excessive Security Scanning - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS User Monitoring"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$.
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Excessive Security Scanning - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`
|
|
|
|
[ESCU - AWS IAM AccessDenied Discovery Events - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
|
|
action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
|
|
action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
|
action.escu.known_false_positives = It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
|
|
action.escu.creation_date = 2021-11-12
|
|
action.escu.modification_date = 2021-11-12
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS IAM AccessDenied Discovery Events - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Security Analytics for AWS"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
|
|
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS IAM AccessDenied Discovery Events - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Blocked", "Stage:Discovery"], "impact": 20, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "userIdentity.arn", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`
|
|
|
|
[ESCU - AWS IAM Assume Role Policy Brute Force - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
|
|
action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
|
|
action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
|
|
action.escu.known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
|
|
action.escu.creation_date = 2021-04-01
|
|
action.escu.modification_date = 2021-04-01
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS IAM Assume Role Policy Brute Force - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Security Analytics for AWS"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name.
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 28}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS IAM Assume Role Policy Brute Force - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Credential Access", "Other:Policy Violation"], "impact": 40, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`
|
|
|
|
[ESCU - AWS IAM Delete Policy - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
|
|
action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
|
action.escu.known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
|
|
action.escu.creation_date = 2021-04-01
|
|
action.escu.modification_date = 2021-04-01
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS IAM Delete Policy - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Security Analytics for AWS"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 10}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS IAM Delete Policy - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Other:Policy Violation"], "impact": 20, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policyArn by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`
|
|
|
|
[ESCU - AWS IAM Failure Group Deletion - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth.
|
|
action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
|
action.escu.known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
|
|
action.escu.creation_date = 2021-04-01
|
|
action.escu.modification_date = 2021-04-01
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS IAM Failure Group Deletion - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Security Analytics for AWS"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ has had mulitple failures while attempting to delete groups from $src$
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_name", "risk_object_type": "user", "risk_score": 5}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS IAM Failure Group Deletion - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}, {"name": "group_name", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_name by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`
|
|
|
|
[ESCU - AWS IAM Successful Group Deletion - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner.
|
|
action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
|
action.escu.known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
|
|
action.escu.creation_date = 2021-03-31
|
|
action.escu.modification_date = 2021-03-31
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS IAM Successful Group Deletion - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Security Analytics for AWS"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_deleted", "risk_object_type": "user", "risk_score": 5}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS IAM Successful Group Deletion - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}, {"name": "group_deleted", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_deleted by src eventName eventSource errorCode user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`
|
|
|
|
[ESCU - AWS Network Access Control List Created with All Open Ports - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
|
|
action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
|
|
action.escu.known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
|
|
action.escu.creation_date = 2021-01-11
|
|
action.escu.modification_date = 2021-01-11
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Network Access Control List Created with All Open Ports - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS Network ACL Activity"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "requestParameters.cidrBlock", "risk_object_type": "system", "risk_score": 48}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Network Access Control List Created with All Open Ports - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "userName", "role": ["Victim"], "type": "User"}, {"name": "requestParameters.cidrBlock", "role": ["Victim"], "type": "IP Address"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 | eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' | where port_range>1024] | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`
|
|
|
|
[ESCU - AWS Network Access Control List Deleted - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
|
|
action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
|
|
action.escu.known_false_positives = It's possible that a user has legitimately deleted a network ACL.
|
|
action.escu.creation_date = 2021-01-12
|
|
action.escu.modification_date = 2021-01-12
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS Network Access Control List Deleted - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS Network ACL Activity"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS Network Access Control List Deleted - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`
|
|
|
|
[ESCU - AWS SAML Access by Provider User and Principal - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider.
|
|
action.escu.mappings = {"mitre_attack": ["T1078"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider.
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
|
|
action.escu.known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS SAML Access by Provider User and Principal - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$
|
|
action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS SAML Access by Provider User and Principal - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 80, "mitre_attack": ["T1078"], "observable": [{"name": "sourceIPAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "recipientAccountId", "role": ["Victim", "Target"], "type": "Other"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_access_by_provider_user_and_principal_filter`
|
|
|
|
[ESCU - AWS SAML Update identity provider - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker.
|
|
action.escu.mappings = {"mitre_attack": ["T1078"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker.
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS SAML Update identity provider - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$
|
|
action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 64}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS SAML Update identity provider - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access"], "impact": 80, "mitre_attack": ["T1078"], "observable": [{"name": "sourceIPAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "userIdentity.principalId", "role": ["Victim", "Target"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter`
|
|
|
|
[ESCU - AWS SetDefaultPolicyVersion - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
|
|
action.escu.creation_date = 2021-03-02
|
|
action.escu.modification_date = 2021-03-02
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS SetDefaultPolicyVersion - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS SetDefaultPolicyVersion - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policy_arn by src requestParameters.versionId eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`
|
|
|
|
[ESCU - AWS UpdateLoginProfile - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
|
|
action.escu.creation_date = 2021-07-19
|
|
action.escu.modification_date = 2021-07-19
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - AWS UpdateLoginProfile - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges
|
|
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - AWS UpdateLoginProfile - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`
|
|
|
|
[ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for new commands from each user role.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for new commands from each user role.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud API Calls Per User Role - Initial` to build the initial table of user roles, commands, and times. You must also enable the second baseline search `Previously Seen Cloud API Calls Per User Role - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_api_calls_from_previously_unseen_user_roles_filter`
|
|
action.escu.known_false_positives = .
|
|
action.escu.creation_date = 2020-09-04
|
|
action.escu.modification_date = 2020-09-04
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) | where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user, object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `cloud_api_calls_from_previously_unseen_user_roles_filter`
|
|
|
|
[ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud compute instances created by users who have not created them before.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud compute instances created by users who have not created them before.
|
|
action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
|
|
action.escu.known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
|
|
action.escu.creation_date = 2021-07-13
|
|
action.escu.modification_date = 2021-07-13
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_by_previously_unseen_user_filter`
|
|
|
|
[ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
|
|
action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
|
|
action.escu.known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
|
|
action.escu.creation_date = 2020-09-02
|
|
action.escu.modification_date = 2020-09-02
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`
|
|
|
|
[ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud compute instances being created with previously unseen image IDs.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud compute instances being created with previously unseen image IDs.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Images - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Images - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` macro.
|
|
action.escu.known_false_positives = After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user.
|
|
action.escu.creation_date = 2018-10-12
|
|
action.escu.modification_date = 2018-10-12
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen.
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user, image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`
|
|
|
|
[ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = Find EC2 instances being created with previously unseen instance types.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = Find EC2 instances being created with previously unseen instance types.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
|
|
action.escu.known_false_positives = It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
|
|
action.escu.creation_date = 2020-09-12
|
|
action.escu.modification_date = 2020-09-12
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen.
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) | where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
|
|
|
|
[ESCU - Cloud Instance Modified By Previously Unseen User - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud instances being modified by users who have not previously modified them.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud instances being modified by users who have not previously modified them.
|
|
action.escu.how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
|
|
action.escu.known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
|
|
action.escu.creation_date = 2020-07-29
|
|
action.escu.modification_date = 2020-07-29
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Instance Modified By Previously Unseen User - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time.
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Instance Modified By Previously Unseen User - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`
|
|
|
|
[ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
|
|
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
|
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
|
action.escu.creation_date = 2020-10-09
|
|
action.escu.modification_date = 2020-10-09
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter` | `security_content_ctime(firstTime)`
|
|
|
|
[ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
|
|
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
|
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
|
action.escu.creation_date = 2020-10-09
|
|
action.escu.modification_date = 2020-10-09
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src, Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter` | `security_content_ctime(firstTime)`
|
|
|
|
[ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
|
|
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
|
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
|
action.escu.creation_date = 2020-08-16
|
|
action.escu.modification_date = 2020-08-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object_id", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` | `security_content_ctime(firstTime)`
|
|
|
|
[ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
|
|
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
|
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
|
action.escu.creation_date = 2020-08-16
|
|
action.escu.modification_date = 2020-08-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter` | `security_content_ctime(firstTime)`
|
|
|
|
[ESCU - Detect AWS Console Login by New User - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Authentication"]
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
|
|
action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
|
action.escu.creation_date = 2020-05-28
|
|
action.escu.modification_date = 2020-05-28
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect AWS Console Login by New User - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect AWS Console Login by New User - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` | join user type=outer [ inputlookup previously_seen_users_console_logins | stats min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`
|
|
|
|
[ESCU - Detect AWS Console Login by User from New City - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Authentication"]
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro.
|
|
action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
|
action.escu.creation_date = 2020-10-07
|
|
action.escu.modification_date = 2020-10-07
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New City - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New City - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins | stats min(firstTime) AS earliestseen by user City | fields earliestseen user City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter`
|
|
|
|
[ESCU - Detect AWS Console Login by User from New Country - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Authentication"]
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro.
|
|
action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
|
action.escu.creation_date = 2020-10-07
|
|
action.escu.modification_date = 2020-10-07
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New Country - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Country - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins | stats min(firstTime) AS earliestseen by user Country | fields earliestseen user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter`
|
|
|
|
[ESCU - Detect AWS Console Login by User from New Region - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Authentication"]
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro.
|
|
action.escu.known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
|
|
action.escu.creation_date = 2020-10-07
|
|
action.escu.modification_date = 2020-10-07
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New Region - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Region - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins | stats min(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`
|
|
|
|
[ESCU - Detect New Open S3 buckets - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk.
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
|
|
action.escu.creation_date = 2021-07-19
|
|
action.escu.modification_date = 2021-07-19
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect New Open S3 buckets - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$
|
|
action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter`
|
|
|
|
[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
|
|
action.escu.how_to_implement =
|
|
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
|
|
action.escu.creation_date = 2021-07-19
|
|
action.escu.modification_date = 2021-07-19
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
|
|
action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter`
|
|
|
|
[ESCU - Detect shared ec2 snapshot - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
|
|
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
|
|
action.escu.known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose.
|
|
action.escu.creation_date = 2021-07-20
|
|
action.escu.modification_date = 2021-07-20
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect shared ec2 snapshot - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$
|
|
action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect shared ec2 snapshot - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter`
|
|
|
|
[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
|
|
action.escu.known_false_positives = None
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["AWS Security Hub Alerts"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
|
|
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
|
|
|
|
[ESCU - O365 Add App Role Assignment Grant User - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Add App Role Assignment Grant User - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$
|
|
action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Add App Role Assignment Grant User - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`
|
|
|
|
[ESCU - O365 Added Service Principal - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Added Service Principal - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$
|
|
action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Added Service Principal - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`
|
|
|
|
[ESCU - O365 Bypass MFA via Trusted IP - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007", "T1562"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
|
|
action.escu.how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
|
|
action.escu.creation_date = 2021-07-19
|
|
action.escu.modification_date = 2021-07-19
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Bypass MFA via Trusted IP - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA
|
|
action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Bypass MFA via Trusted IP - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007", "T1562"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`
|
|
|
|
[ESCU - O365 Disable MFA - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = Unless it is a special case, it is uncommon to disable MFA or Strong Authentication
|
|
action.escu.creation_date = 2020-12-16
|
|
action.escu.modification_date = 2020-12-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Disable MFA - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$
|
|
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Disable MFA - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Operation="Disable Strong Authentication." | stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_disable_mfa_filter`
|
|
|
|
[ESCU - O365 Excessive Authentication Failures Alert - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes
|
|
action.escu.mappings = {"kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives.
|
|
action.escu.creation_date = 2020-12-16
|
|
action.escu.modification_date = 2020-12-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Excessive Authentication Failures Alert - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$.
|
|
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Excessive Authentication Failures Alert - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`
|
|
|
|
[ESCU - O365 Excessive SSO logon errors - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Excessive SSO logon errors - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$.
|
|
action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Excessive SSO logon errors - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`
|
|
|
|
[ESCU - O365 New Federated Domain Added - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects the addition of a new Federated domain.
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects the addition of a new Federated domain.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity.
|
|
action.escu.known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
|
|
action.escu.creation_date = 2021-01-26
|
|
action.escu.modification_date = 2021-01-26
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 New Federated Domain Added - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$
|
|
action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 New Federated Domain Added - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`
|
|
|
|
[ESCU - O365 PST export alert - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
|
|
action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
|
|
action.escu.creation_date = 2020-12-16
|
|
action.escu.modification_date = 2020-12-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 PST export alert - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$
|
|
action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 PST export alert - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"], "observable": [{"name": "Source", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" | stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`
|
|
|
|
[ESCU - O365 Suspicious Admin Email Forwarding - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = unknown
|
|
action.escu.creation_date = 2020-12-16
|
|
action.escu.modification_date = 2020-12-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Suspicious Admin Email Forwarding - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Suspicious Admin Email Forwarding - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter`
|
|
|
|
[ESCU - O365 Suspicious Rights Delegation - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account.
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = Service Accounts
|
|
action.escu.creation_date = 2020-12-15
|
|
action.escu.modification_date = 2020-12-15
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Suspicious Rights Delegation - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Suspicious Rights Delegation - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Operation=Add-MailboxPermission | spath input=Parameters | rename User AS src_user, Identity AS dest_user | search AccessRights=FullAccess OR AccessRights=SendAs OR AccessRights=SendOnBehalf | stats count earliest(_time) as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_rights_delegation_filter`
|
|
|
|
[ESCU - O365 Suspicious User Email Forwarding - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search detects when multiple user configured a forwarding rule to the same destination.
|
|
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search detects when multiple user configured a forwarding rule to the same destination.
|
|
action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
|
|
action.escu.known_false_positives = unknown
|
|
action.escu.creation_date = 2020-12-16
|
|
action.escu.modification_date = 2020-12-16
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - O365 Suspicious User Email Forwarding - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$
|
|
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - O365 Suspicious User Email Forwarding - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "ForwardingSmtpAddress", "role": ["Other"], "type": "Email Address"}]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`
|
|
|
|
[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
|
|
action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
|
|
action.escu.creation_date = 2020-08-21
|
|
action.escu.modification_date = 2020-08-21
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message =
|
|
action.risk.param._risk = []
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`
|
|
|
|
[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
|
|
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
|
|
action.escu.data_models = ["Change"]
|
|
action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
|
|
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
|
|
action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
|
|
action.escu.creation_date = 2020-08-21
|
|
action.escu.modification_date = 2020-08-21
|
|
action.escu.confidence = high
|
|
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
|
action.escu.providing_technologies = []
|
|
action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
|
|
action.risk = 1
|
|
action.risk.param._risk_message =
|
|
action.risk.param._risk = []
|
|
action.risk.param.verbose = 0
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
|
|
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
|
|
schedule_window = auto
|
|
alert.digest_mode = 1
|
|
disabled = false
|
|
enableSched = 1
|
|
allow_skew = 100%
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
is_visible = false
|
|
search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`
|
|
|
|
### END ESCU DETECTIONS ###
|
|
|
|
|
|
### ESCU BASELINES ###
|
|
|
|
[ESCU - Baseline Of Cloud Infrastructure API Calls Per User]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls Per User
|
|
description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
|
|
action.escu.creation_date = 2020-09-07
|
|
action.escu.modification_date = 2020-09-07
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 2 * * 0
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
|
|
action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true
|
|
|
|
[ESCU - Baseline Of Cloud Instances Destroyed]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed
|
|
description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window.
|
|
action.escu.creation_date = 2020-08-25
|
|
action.escu.modification_date = 2020-08-25
|
|
action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 2 * * 0
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window.
|
|
action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\
|
|
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true
|
|
|
|
[ESCU - Baseline Of Cloud Instances Launched]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched
|
|
description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
|
|
action.escu.creation_date = 2020-08-14
|
|
action.escu.modification_date = 2020-08-14
|
|
action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 2 * * 0
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
|
|
action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\
|
|
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true
|
|
|
|
[ESCU - Baseline Of Cloud Security Group API Calls Per User]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls Per User
|
|
description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly.
|
|
action.escu.creation_date = 2020-09-07
|
|
action.escu.modification_date = 2020-09-07
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 2 * * 0
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly.
|
|
action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true
|
|
|
|
[ESCU - Previously Seen AWS Cross Account Activity - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Initial
|
|
description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
|
|
action.escu.creation_date = 2020-08-15
|
|
action.escu.modification_date = 2020-08-15
|
|
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
|
|
action.escu.data_models = ["Authentication"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity
|
|
|
|
[ESCU - Previously Seen AWS Cross Account Activity - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Update
|
|
description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
|
|
action.escu.creation_date = 2020-08-15
|
|
action.escu.modification_date = 2020-08-15
|
|
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
|
|
action.escu.data_models = ["Authentication"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity
|
|
|
|
[ESCU - Previously Seen Cloud API Calls Per User Role - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Initial
|
|
description = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached.
|
|
action.escu.creation_date = 2020-09-03
|
|
action.escu.modification_date = 2020-09-03
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached.
|
|
action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role
|
|
|
|
[ESCU - Previously Seen Cloud API Calls Per User Role - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Update
|
|
description = This search updates the table of the first and last times seen for every user role and command combination.
|
|
action.escu.creation_date = 2020-09-03
|
|
action.escu.modification_date = 2020-09-03
|
|
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search updates the table of the first and last times seen for every user role and command combination.
|
|
action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role
|
|
|
|
[ESCU - Previously Seen Cloud Compute Creations By User - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Initial
|
|
description = This search builds a table of previously seen users that have launched a cloud compute instance.
|
|
action.escu.creation_date = 2020-08-15
|
|
action.escu.modification_date = 2020-08-15
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 55 * * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance.
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count
|
|
|
|
[ESCU - Previously Seen Cloud Compute Creations By User - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Update
|
|
description = This search builds a table of previously seen users that have launched a cloud compute instance.
|
|
action.escu.creation_date = 2020-08-15
|
|
action.escu.modification_date = 2020-08-15
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance.
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user
|
|
|
|
[ESCU - Previously Seen Cloud Compute Images - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Initial
|
|
description = This search builds a table of previously seen images used to launch cloud compute instances
|
|
action.escu.creation_date = 2020-10-08
|
|
action.escu.modification_date = 2020-10-08
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images
|
|
|
|
[ESCU - Previously Seen Cloud Compute Images - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Update
|
|
description = This search builds a table of previously seen images used to launch cloud compute instances
|
|
action.escu.creation_date = 2020-08-12
|
|
action.escu.modification_date = 2020-08-12
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images
|
|
|
|
[ESCU - Previously Seen Cloud Compute Instance Types - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Initial
|
|
description = This search builds a table of previously seen cloud compute instance types
|
|
action.escu.creation_date = 2020-9-03
|
|
action.escu.modification_date = 2020-9-03
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen cloud compute instance types
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types
|
|
|
|
[ESCU - Previously Seen Cloud Compute Instance Types - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Update
|
|
description = This search builds a table of previously seen cloud compute instance types
|
|
action.escu.creation_date = 2020-9-03
|
|
action.escu.modification_date = 2020-9-03
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen cloud compute instance types
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types
|
|
|
|
[ESCU - Previously Seen Cloud Instance Modifications By User - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Initial
|
|
description = This search builds a table of previously seen users that have modified a cloud instance.
|
|
action.escu.creation_date = 2020-07-29
|
|
action.escu.modification_date = 2020-07-29
|
|
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance.
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user
|
|
|
|
[ESCU - Previously Seen Cloud Instance Modifications By User - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Update
|
|
description = This search updates a table of previously seen Cloud Instance modifications that have been made by a user
|
|
action.escu.creation_date = 2020-07-29
|
|
action.escu.modification_date = 2020-07-29
|
|
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search updates a table of previously seen Cloud Instance modifications that have been made by a user
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user
|
|
|
|
[ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial
|
|
description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached.
|
|
action.escu.creation_date = 2020-08-19
|
|
action.escu.modification_date = 2020-08-19
|
|
action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached.
|
|
action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources
|
|
|
|
[ESCU - Previously Seen Cloud Provisioning Activity Sources - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update
|
|
description = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached.
|
|
action.escu.creation_date = 2020-08-20
|
|
action.escu.modification_date = 2020-08-20
|
|
action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached.
|
|
action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources
|
|
|
|
[ESCU - Previously Seen Cloud Regions - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial
|
|
description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
|
|
action.escu.creation_date = 2020-09-02
|
|
action.escu.modification_date = 2020-09-02
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions
|
|
|
|
[ESCU - Previously Seen Cloud Regions - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update
|
|
description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
|
|
action.escu.creation_date = 2020-09-02
|
|
action.escu.modification_date = 2020-09-02
|
|
action.escu.analytic_story = ["Cloud Cryptomining"]
|
|
action.escu.data_models = ["Change"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
|
|
action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count
|
|
|
|
[ESCU - Previously Seen Users in CloudTrail - Initial]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Initial
|
|
description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.
|
|
action.escu.creation_date = 2020-05-28
|
|
action.escu.modification_date = 2020-05-28
|
|
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
|
|
action.escu.data_models = ["Authentication"]
|
|
cron_schedule = 0 1 1 1,4,7,10 *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -90d@d
|
|
dispatch.latest_time = -1d@d
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count
|
|
|
|
[ESCU - Previously Seen Users In CloudTrail - Update]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update
|
|
description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
|
|
action.escu.creation_date = 2020-05-28
|
|
action.escu.modification_date = 2020-05-28
|
|
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
|
|
action.escu.data_models = ["Authentication"]
|
|
cron_schedule = 10 0 * * *
|
|
enableSched = 1
|
|
dispatch.earliest_time = -1450m@m
|
|
dispatch.latest_time = -10m@m
|
|
schedule_window = auto
|
|
action.escu.providing_technologies = []
|
|
action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
|
|
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
|
|
disabled = false
|
|
is_visible = false
|
|
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins
|
|
|
|
|
|
|
|
### ESCU RESPONSE TASKS ###
|
|
|
|
[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task
|
|
description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
|
|
action.escu.creation_date = 2020-04-13
|
|
action.escu.modification_date = 2020-04-13
|
|
action.escu.analytic_story = ["Kubernetes Scanning Activity"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip
|
|
|
|
[ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS Investigate Security Hub alerts by dest - Response Task
|
|
description = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id).
|
|
action.escu.creation_date = 2020-06-08
|
|
action.escu.modification_date = 2020-06-08
|
|
action.escu.analytic_story = ["Cloud Compute Instance", "Cloud Cryptomining", "Suspicious AWS EC2 Activities", "AWS Suspicious Provisioning Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id).
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation
|
|
|
|
[ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS Investigate User Activities By AccessKeyId - Response Task
|
|
description = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials.
|
|
action.escu.creation_date = 2018-06-08
|
|
action.escu.modification_date = 2018-06-08
|
|
action.escu.analytic_story = ["AWS Cross Account Activity"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage
|
|
|
|
[ESCU - AWS Investigate User Activities By ARN - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task
|
|
description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
|
|
action.escu.creation_date = 2019-04-30
|
|
action.escu.modification_date = 2019-04-30
|
|
action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
|
|
|
|
[ESCU - AWS Network ACL Details from ID - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS Network ACL Details from ID - Response Task
|
|
description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID
|
|
action.escu.creation_date = 2017-01-22
|
|
action.escu.modification_date = 2017-01-22
|
|
action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.*
|
|
|
|
[ESCU - AWS Network Interface details via resourceId - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS Network Interface details via resourceId - Response Task
|
|
description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface.
|
|
action.escu.creation_date = 2018-05-07
|
|
action.escu.modification_date = 2018-05-07
|
|
action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp
|
|
|
|
[ESCU - AWS S3 Bucket details via bucketName - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS S3 Bucket details via bucketName - Response Task
|
|
description = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket.
|
|
action.escu.creation_date = 2018-06-26
|
|
action.escu.modification_date = 2018-06-26
|
|
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList
|
|
|
|
[ESCU - Get All AWS Activity From City - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Get All AWS Activity From City - Response Task
|
|
description = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.creation_date = 2018-03-19
|
|
action.escu.modification_date = 2018-03-19
|
|
action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode
|
|
|
|
[ESCU - Get All AWS Activity From Country - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Get All AWS Activity From Country - Response Task
|
|
description = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.creation_date = 2018-03-19
|
|
action.escu.modification_date = 2018-03-19
|
|
action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode
|
|
|
|
[ESCU - Get All AWS Activity From IP Address - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Get All AWS Activity From IP Address - Response Task
|
|
description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.creation_date = 2018-03-19
|
|
action.escu.modification_date = 2018-03-19
|
|
action.escu.analytic_story = ["AWS Network ACL Activity", "AWS Suspicious Provisioning Activities", "Command and Control", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Cloud Instance Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode
|
|
|
|
[ESCU - Get All AWS Activity From Region - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Get All AWS Activity From Region - Response Task
|
|
description = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.creation_date = 2018-03-19
|
|
action.escu.modification_date = 2018-03-19
|
|
action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode
|
|
|
|
[ESCU - Get EC2 Instance Details by instanceId - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Get EC2 Instance Details by instanceId - Response Task
|
|
description = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field
|
|
action.escu.creation_date = 2018-02-12
|
|
action.escu.modification_date = 2018-02-12
|
|
action.escu.analytic_story = ["AWS Cryptomining", "Cloud Cryptomining", "Suspicious AWS EC2 Activities", "Unusual AWS EC2 Modifications", "AWS Security Hub Alerts"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC
|
|
|
|
[ESCU - Get EC2 Launch Details - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Get EC2 Launch Details - Response Task
|
|
description = This search returns some of the launch details for a EC2 instance.
|
|
action.escu.creation_date = 2018-03-12
|
|
action.escu.modification_date = 2018-03-12
|
|
action.escu.analytic_story = ["AWS Cryptomining", "Cloud Cryptomining", "Suspicious AWS EC2 Activities", "AWS Security Hub Alerts"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search returns some of the launch details for a EC2 instance.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName
|
|
|
|
[ESCU - Investigate AWS activities via region name - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Investigate AWS activities via region name - Response Task
|
|
description = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user
|
|
action.escu.creation_date = 2018-02-09
|
|
action.escu.modification_date = 2018-02-09
|
|
action.escu.analytic_story = ["AWS Cryptomining", "Cloud Cryptomining", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region
|
|
|
|
[ESCU - Investigate AWS User Activities by user field - Response Task]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task
|
|
description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
|
|
action.escu.creation_date = 2018-03-12
|
|
action.escu.modification_date = 2018-03-12
|
|
action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = []
|
|
action.escu.data_models = []
|
|
action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
|
|
action.escu.how_to_implement = none
|
|
action.escu.known_false_positives = None at this time
|
|
disabled = true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
|
|
|
|
|
|
|
|
### END ESCU RESPONSE TASKS ### |