mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
75 lines
2.5 KiB
YAML
75 lines
2.5 KiB
YAML
name: Detect New Open S3 buckets
|
|
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
|
|
version: 3
|
|
date: '2021-07-19'
|
|
author: Bhavin Patel, Patrick Bareiss, Splunk
|
|
type: TTP
|
|
datamodel: []
|
|
description: This search looks for AWS CloudTrail events where a user has created
|
|
an open/public S3 bucket.
|
|
search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
|
|
"(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
|
|
| search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI
|
|
| spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
|
|
| search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") |
|
|
rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime
|
|
max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission
|
|
bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
|
| `detect_new_open_s3_buckets_filter` '
|
|
how_to_implement: You must install the AWS App for Splunk.
|
|
known_false_positives: While this search has no known false positives, it is possible
|
|
that an AWS admin has legitimately created a public bucket for a specific purpose.
|
|
That said, AWS strongly advises against granting full control to the "All Users"
|
|
group.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Suspicious AWS S3 Activities
|
|
asset_type: S3 Bucket
|
|
cis20:
|
|
- CIS 13
|
|
confidence: 80
|
|
context:
|
|
- Source:Cloud Data
|
|
- Scope:External
|
|
- Outcome:Allowed
|
|
- Stage:Execution
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json
|
|
impact: 60
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: User $user_arn$ has created an open/public bucket $bucketName$ with the
|
|
following permissions $permission$
|
|
mitre_attack_id:
|
|
- T1530
|
|
nist:
|
|
- PR.DS
|
|
- PR.AC
|
|
- DE.CM
|
|
observable:
|
|
- name: user_arn
|
|
type: User
|
|
role:
|
|
- Attacker
|
|
- name: bucketName
|
|
type: Other
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- eventSource
|
|
- eventName
|
|
- requestParameters.bucketName
|
|
- user_arn
|
|
- userIdentity.principalId
|
|
- userAgent
|
|
- uri
|
|
- permission
|
|
risk_score: 48
|
|
security_domain: threat
|