splunk-security_content/docs/_posts/2021-04-13-aws_excessive_security_scanning.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
AWS Excessive Security Scanning	Cloud Service Discovery	Cloud	2021-04-13	true		Cloud Service Discovery Discovery Splunk Security Analytics for AWS Splunk Enterprise Splunk Enterprise Security Splunk Cloud

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.

• Type: TTP
• Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel:
• Last Updated: 2021-04-13
• Author: Patrick Bareiss, Splunk
• ID: 1fdd164a-def8-4762-83a9-9ffe24e74d5a

ATT&CK

ID	Technique	Tactic
T1526	Cloud Service Discovery	Discovery

Search

`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  
| stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn 
| where dc_events > 50 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
|`aws_excessive_security_scanning_filter`

Associated Analytic Story

• AWS User Monitoring

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.

Required field

• _time
• eventName
• src
• userAgent
• user
• userIdentity.arn

Kill Chain Phase

• Actions on Objectives

Known False Positives

While this search has no known false positives.

RBA

Risk Score	Impact	Confidence	Message
18.0	30	60	user user has excessive number of api calls dc_events from these IP addresses src, violating the threshold of 50, using the following commands command.

Reference

• https://github.com/aquasecurity/cloudsploit

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json

source | version: 1