mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
38 lines
1.9 KiB
YAML
38 lines
1.9 KiB
YAML
name: EC2 Instance Started With Previously Unseen User
|
|
id: 22773e84-bac0-4595-b086-20d3f735b4f1
|
|
version: 1
|
|
date: '2018-03-12'
|
|
description: This search looks for EC2 instances being created by users who have not
|
|
created them before.
|
|
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
|
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
|
inputs. This search works best when you run the "Previously Seen EC2 Launches By
|
|
User" support search once to create a history of previously seen ARNs.
|
|
type: ESCU
|
|
references: []
|
|
author: David Dorsey, Splunk
|
|
search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
|
|
errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime
|
|
by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv
|
|
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup
|
|
previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(),
|
|
"-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType
|
|
as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
|
|
as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
|
|
known_false_positives: It's possible that a user will start to create EC2 instances
|
|
when they haven't before for any number of reasons. Verify with the user that is
|
|
launching instances that this is the intended behavior.
|
|
tags:
|
|
analytics_story:
|
|
- AWS Cryptomining
|
|
- Suspicious AWS EC2 Activities
|
|
mitre_attack_id:
|
|
- T1078
|
|
cis20:
|
|
- CIS 1
|
|
nist:
|
|
- ID.AM
|
|
security_domain: endpoint
|
|
asset_type: AWS Instance
|