splunk-security_content/dist/devsecops/default/savedsearches.conf

#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-13T10:57:27 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

### ESCU DETECTIONS ###

[ESCU - AWS ECR Container Scanning Findings High - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in image $image$
action.risk.param._risk = [{"threat_object_field": "image", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.slack = 1
action.slack.param.channel = dev_sec_ops_analytics
action.slack.param.message = Alert AWS ECR Container Scanning Findings High
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` | eval risk_score=70 | eval mitre_attack_id=T1204.003 | collect index=alerts

[ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings Low Informational Unknown
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="low" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter` | eval risk_score=7 | eval mitre_attack_id=T1204.003

[ESCU - AWS ECR Container Scanning Findings Medium - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Medium - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in image $image$
action.risk.param._risk = [{"threat_object_field": "image", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Medium - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings Medium
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` | eval risk_score=21 | eval mitre_attack_id=T1204.003 | collect index=signals

[ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Container uploaded outside business hours from $user$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.notable.param.rule_title = AWS ECR Container Upload Outside Business Hours
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.* as * | rename repositoryName AS image | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter` | eval risk_score=49 | eval mitre_attack_id=T1204.003 | collect index=signals

[ESCU - AWS ECR Container Upload Unknown User - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Upload Unknown User - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Container uploaded from unknown user $user$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Upload Unknown User - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.notable.param.rule_title = AWS ECR Container Upload Unknown User
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users` | rename requestParameters.* as * | rename repositoryName AS image | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_unknown_user_filter` | eval risk_score=49 | eval mitre_attack_id=T1204.003 | collect index=signals

[ESCU - Circle CI Disable Security Job - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for disable security job in CircleCI pipeline.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for disable security job in CircleCI pipeline.
action.escu.how_to_implement = You must index CircleCI logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-09-02
action.escu.modification_date = 2021-09-02
action.escu.confidence = high
action.escu.full_search_name = ESCU - Circle CI Disable Security Job - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Circle CI Disable Security Job - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search looks for disable security job in CircleCI pipeline.
action.notable.param.rule_title = Circle CI Disable Security Job
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `circleci` | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as *  | stats values(job_name) as job_names by workflow_id workflow_name user commit_message url branch | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 | eval phase="build" | rex field=url "(?<repository>[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter` | eval risk_score=72 | eval mitre_attack_id=T1554 | collect index=signals

[ESCU - Circle CI Disable Security Step - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for disable security step in CircleCI pipeline.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for disable security step in CircleCI pipeline.
action.escu.how_to_implement = You must index CircleCI logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-09-01
action.escu.modification_date = 2021-09-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - Circle CI Disable Security Step - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = disable security step $mandatory_step$ in job $job_name$ from user $user$
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Circle CI Disable Security Step - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search looks for disable security step in CircleCI pipeline.
action.notable.param.rule_title = Circle CI Disable Security Step
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as * , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url "(?<repository>[^\/]*\/[^\/]*)$" | eval phase="build"  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter` | eval risk_score=72 | eval mitre_attack_id=T1554 | collect index=signals

[ESCU - Correlation by Repository and Risk - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search correlations detections by repository and risk_score
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search correlations detections by repository and risk_score
action.escu.how_to_implement = For Dev Sec Ops POC
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-09-06
action.escu.modification_date = 2021-09-06
action.escu.confidence = high
action.escu.full_search_name = ESCU - Correlation by Repository and Risk - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Correlation triggered for user $user$
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Correlation by Repository and Risk - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.slack = 1
action.slack.param.channel = dev_sec_ops_analytics
action.slack.param.message = Alert Correlation by Repository and Risk
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `signals` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository | sort - risk_score | where risk_score > 80 | `correlation_by_repository_and_risk_filter` | eval risk_score=70 | eval mitre_attack_id=T1204.003 | collect index=alerts

[ESCU - Correlation by User and Risk - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search correlations detections by user and risk_score
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search correlations detections by user and risk_score
action.escu.how_to_implement = For Dev Sec Ops POC
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-09-06
action.escu.modification_date = 2021-09-06
action.escu.confidence = high
action.escu.full_search_name = ESCU - Correlation by User and Risk - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Correlation triggered for user $user$
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Correlation by User and Risk - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.slack = 1
action.slack.param.channel = dev_sec_ops_analytics
action.slack.param.message = Alert Correlation by User and Risk
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `signals` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user | sort - risk_score | where risk_score > 80 | `correlation_by_user_and_risk_filter` | eval risk_score=70 | eval mitre_attack_id=T1204.003 | collect index=alerts

[ESCU - GSuite Email Suspicious Attachment - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
action.escu.creation_date = 2021-08-16
action.escu.modification_date = 2021-08-16
action.escu.confidence = high
action.escu.full_search_name = ESCU - GSuite Email Suspicious Attachment - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "destination{}.address", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - GSuite Email Suspicious Attachment - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.notable.param.rule_title = GSuite Email Suspicious Attachment
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") | eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments  subject destination{}.address source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_attachment_filter` | eval risk_score=49 | eval mitre_attack_id=T1566.001 | collect index=signals

[ESCU - GitHub Dependabot Alert - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for Dependabot Alerts in Github logs.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for Dependabot Alerts in Github logs.
action.escu.how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-09-01
action.escu.modification_date = 2021-09-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - GitHub Dependabot Alert - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities found in packages used by GitHub repository $repository$
action.risk.param._risk = [{"threat_object_field": "repository", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - GitHub Dependabot Alert - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search looks for Dependabot Alerts in Github logs.
action.notable.param.rule_title = GitHub Dependabot Alert
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter` | eval risk_score=27 | eval mitre_attack_id=T1195.001 | collect index=signals

[ESCU - GitHub Pull Request from Unknown User - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for Pull Request from unknown user.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for Pull Request from unknown user.
action.escu.how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-09-01
action.escu.modification_date = 2021-09-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - GitHub Pull Request from Unknown User - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities found in packages used by GitHub repository $repository$
action.risk.param._risk = [{"threat_object_field": "repository", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - GitHub Pull Request from Unknown User - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search looks for Pull Request from unknown user.
action.notable.param.rule_title = GitHub Pull Request from Unknown User
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message | rename check_suite.head_commit.author.name as user repository.full_name as repository check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users` | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter` | eval risk_score=27 | eval mitre_attack_id=T1195.001 | collect index=signals

[ESCU - Github Commit Changes In Master - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
action.escu.known_false_positives = admin can do changes directly to master branch
action.escu.creation_date = 2021-08-20
action.escu.modification_date = 2021-08-20
action.escu.confidence = high
action.escu.full_search_name = ESCU - Github Commit Changes In Master - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious commit by $commit.commit.author.email$ to main branch
action.risk.param._risk = [{"risk_object_field": "commit.commit.author.email", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Github Commit Changes In Master - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
action.notable.param.rule_title = Github Commit Changes In Master
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `github` branches{}.name = main OR branches{}.name = master | eval severity="low" | eval phase="code" |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter` | eval risk_score=9 | eval mitre_attack_id=T1199 | collect index=signals

[ESCU - Github Commit In Develop - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
action.escu.known_false_positives = admin can do changes directly to develop branch
action.escu.creation_date = 2021-09-01
action.escu.modification_date = 2021-09-01
action.escu.confidence = high
action.escu.full_search_name = ESCU - Github Commit In Develop - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious commit by $commit.commit.author.email$ to develop branch
action.risk.param._risk = [{"risk_object_field": "commit.commit.author.email", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Github Commit In Develop - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
action.notable.param.rule_title = Github Commit In Develop
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `github` branches{}.name = main OR branches{}.name = develop |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_in_develop_filter` | eval risk_score=9 | eval mitre_attack_id=T1199 | collect index=signals

[ESCU - Gsuite Drive Share In External Email - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin or normal user may share files to customer and external team.
action.escu.creation_date = 2021-08-16
action.escu.modification_date = 2021-08-16
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Drive Share In External Email - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Drive Share In External Email - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.sendtophantom = 1
action.sendtophantom.param._cam_workers = local
action.sendtophantom.param.label = events
action.sendtophantom.param.phantom_server = events
action.sendtophantom.param.sensitivity = amber
action.sendtophantom.param.severity = medium
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)" | rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, values(parameters.doc_id) as doc_id, count min(_time) as firstTime max(_time) as lastTime by parameters.owner phase severity | rename parameters.owner as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter` | eval risk_score=9 | eval mitre_attack_id=T1567.002 | collect index=signals

[ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = []
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.notable.param.rule_title = Gsuite Email Suspicious Subject With Attachment
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments  subject destination{}.address source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_subject_with_attachment_filter` | eval risk_score=25 | eval mitre_attack_id=T1566.001 | collect index=signals

[ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
action.escu = 0
action.escu.enabled = 1
description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = []
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.notable.param.rule_title = Gsuite Email With Known Abuse Web Service Link
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter` | eval risk_score=25 | eval mitre_attack_id=T1566.001 | collect index=signals

[ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "destination{}.address", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.notable.param.rule_title = Gsuite Outbound Email With Attachment To External Domain
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime by dest_domain phase severity | where numSrcAddresses < 20 |sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_outbound_email_with_attachment_to_external_domain_filter` | eval risk_score=9 | eval mitre_attack_id=T1048.003 | collect index=signals

[ESCU - Gsuite Suspicious Shared File Name - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Suspicious Shared File Name - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Suspicious Shared File Name - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.notable.param.rule_title = Gsuite Suspicious Shared File Name
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter` | eval risk_score=9 | eval mitre_attack_id=T1566.001 | collect index=signals

[ESCU - Kubernetes Nginx Ingress LFI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-20
action.escu.modification_date = 2021-08-20
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress LFI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Local File Inclusion Attack detected on $host$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress LFI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.slack = 1
action.slack.param.channel = dev_sec_ops_analytics
action.slack.param.message = Alert Kubernetes Nginx Ingress LFI
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter` | eval risk_score=49 | eval mitre_attack_id=T1212 | collect index=alerts

[ESCU - Kubernetes Nginx Ingress RFI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress RFI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Remote File Inclusion Attack detected on $host$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress RFI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.slack = 1
action.slack.param.channel = dev_sec_ops_analytics
action.slack.param.message = Alert Kubernetes Nginx Ingress RFI
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter` | eval risk_score=49 | eval mitre_attack_id=T1212 | collect index=alerts

[ESCU - Kubernetes Scanner Image Pulling - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-24
action.escu.modification_date = 2021-08-24
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Scanner Image Pulling - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Kubernetes Scanner image pulled on host $host$
action.risk.param._risk = [{"threat_object_field": "host", "threat_object_type": "entity"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -60m
dispatch.latest_time = now
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Scanner Image Pulling - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "host", "type": "Entity"}]}
schedule_window = auto
action.slack = 1
action.slack.param.channel = dev_sec_ops_analytics
action.slack.param.message = Alert Kubernetes Scanner Image Pulling
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host | eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter` | eval risk_score=81 | eval mitre_attack_id=T1526 | collect index=alerts

### END ESCU DETECTIONS ###


### ESCU BASELINES ###



### ESCU RESPONSE TASKS ###



### END ESCU RESPONSE TASKS ###

### USAGE DASHBOARD CONFIGURATIONS ###

[escu-metrics-usage]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

[escu-metrics-search]
action.email.useNSSubject = 1
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)

[escu-metrics-search-events]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")

[escu-metrics-search-longest-runtime]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
disabled = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id

[escu-metrics-usage-search]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
enableSched = 1
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

### END OF USAGE DASHBOARD CONFIGURATIONS ###