mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
82 lines
3.8 KiB
JSON
82 lines
3.8 KiB
JSON
{
|
|
"asset_type": "AWS Instance",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "userName",
|
|
"rule_description": "An abnormally high number of instances were terminated by a user in a 10-minute window",
|
|
"rule_title": "High number of instances terminated by $userName$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "userName",
|
|
"risk_object_type": [
|
|
"user"
|
|
],
|
|
"risk_score": 30
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "userName",
|
|
"suppress_period": "3600s"
|
|
}
|
|
},
|
|
"creation_date": "2018-02-26",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"AWS CloudTrail logs"
|
|
],
|
|
"data_sourcetypes": [
|
|
"aws:cloudtrail"
|
|
],
|
|
"providing_technologies": [
|
|
"AWS"
|
|
]
|
|
},
|
|
"eli5": "In this search, we query CloudTrail logs to look for events where an instance is successfully terminated by a particular user. Since we want to detect a high number of instances terminated within a short period, we create event buckets for 10-minute windows. We then calculate the total number of instances terminated by a particular user, as well as the average- and standard-deviation values. Assign a <code>threshold_value</code> in the search. Try starting with 3 (but it will likely need to be tweaked for your environment). The <code>eval</code> function will set the outlier to 1 if the number of instances is greater than the average number of instances terminated, added to the multiplied value of threshold and standard deviation. We then filter out outliers with a value of 1 and show only those instance-termination events that happened within the previous 10 minutes.",
|
|
"how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.",
|
|
"known_false_positives": "Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 13"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution"
|
|
],
|
|
"nist": [
|
|
"DE.DP",
|
|
"DE.AE"
|
|
]
|
|
},
|
|
"modification_date": "2018-02-26",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "*/10 * * * *",
|
|
"earliest_time": "-30d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=aws:cloudtrail eventName=TerminateInstances errorCode=success | bucket span=10m _time | stats count AS instances_terminated by _time userName | eventstats avg(instances_terminated) as total_terminations_avg, stdev(instances_terminated) as total_terminations_stdev | eval threshold_value = 4 | eval isOutlier=if(instances_terminated > total_terminations_avg+(total_terminations_stdev * threshold_value), 1, 0) | search isOutlier=1 AND _time >= relative_time(now(), \"-10m@m\")| eval num_standard_deviations_away = round(abs(instances_terminated - total_terminations_avg) / total_terminations_stdev, 2) |table _time, userName, instances_terminated, num_standard_deviations_away, total_terminations_avg, total_terminations_stdev",
|
|
"search_description": "This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window",
|
|
"search_id": "ada0f478-84a8-4641-s3f3-d82362dffd75",
|
|
"search_name": "Abnormally High AWS Instances Terminated by User",
|
|
"search_type": "detection",
|
|
"security_domain": "network",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|