mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
name: AWS ECR Container Upload Unknown User
|
|
id: 300688e4-365c-4486-a065-7c884462b31d
|
|
version: 1
|
|
date: '2021-08-19'
|
|
author: Patrick Bareiss, Splunk
|
|
type: Anomaly
|
|
datamodel: []
|
|
description: This search looks for AWS CloudTrail events from AWS Elastic Container
|
|
Service (ECR). A upload of a new container is normally done from only a few known
|
|
users. When the user was never seen before, we should have a closer look into the
|
|
event.
|
|
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
|
|
| rename requestParameters.* as * | rename repositoryName AS image | eval phase="release"
|
|
| eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by
|
|
awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId,
|
|
image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `aws_ecr_container_upload_unknown_user_filter`'
|
|
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
|
|
search works with AWS CloudTrail logs.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1204/003/
|
|
tags:
|
|
analytic_story:
|
|
- Dev Sec Ops
|
|
asset_type: AWS Account
|
|
cis20:
|
|
- CIS 13
|
|
confidence: 70
|
|
context:
|
|
- Source:Cloud Data
|
|
- Stage:Discovery
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: Container uploaded from unknown user $user$
|
|
mitre_attack_id:
|
|
- T1204.003
|
|
- T1204
|
|
nist:
|
|
- PR.DS
|
|
- PR.AC
|
|
- DE.CM
|
|
observable:
|
|
- name: src_ip
|
|
type: IP Address
|
|
role:
|
|
- Attacker
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- eventSource
|
|
- eventName
|
|
- awsRegion
|
|
- requestParameters.imageTag
|
|
- requestParameters.registryId
|
|
- requestParameters.repositoryName
|
|
- user
|
|
- userName
|
|
- src_ip
|
|
risk_score: 49
|
|
security_domain: network
|