mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
100 lines
8.0 KiB
Plaintext
100 lines
8.0 KiB
Plaintext
### ESCU DETECTIONS ###
|
|
|
|
[ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
description = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create."
|
|
action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
|
|
action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each city. It returns only those events from cities that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action.
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
|
|
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
|
|
\
|
|
This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
|
|
action.escu.creation_date = 2018-03-16
|
|
action.escu.modification_date = 2018-03-16
|
|
action.escu.confidence = medium
|
|
action.escu.full_search_name = ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule
|
|
action.escu.search_type = detection
|
|
action.escu.asset_at_risk = AWS Instance
|
|
action.escu.fields_required = ["dest"]
|
|
action.escu.providing_technologies = ["AWS"]
|
|
action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
|
|
cron_schedule = 0 * * * *
|
|
dispatch.earliest_time = -70m@m
|
|
dispatch.latest_time = -10m@m
|
|
action.correlationsearch.enabled = 1
|
|
action.correlationsearch.label = AWS Cloud Provisioning From Previously Unseen City
|
|
action.notable = 1
|
|
action.notable.param.nes_fields = src_ip, city
|
|
action.notable.param.rule_description = Your AWS infrastructure was provisioned from a city, $city$, which has never before been seen provisioning your infrastructure.
|
|
action.notable.param.rule_title = AWS Provision Activity From $city$
|
|
action.notable.param.security_domain = endpoint
|
|
action.notable.param.severity = medium
|
|
action.risk = 1
|
|
action.risk.param._risk_object = dest
|
|
action.risk.param._risk_object_type = system
|
|
action.risk.param._risk_score = 30
|
|
action.risk.param.verbose = 0
|
|
alert.digest_mode = 1
|
|
alert.suppress = 1
|
|
alert.suppress.fields = dest
|
|
alert.suppress.period = 14400s
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
disabled=true
|
|
enableSched = 1
|
|
counttype = number of events
|
|
relation = greater than
|
|
quantity = 0
|
|
realtime_schedule = 0
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | search City=* [search sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | search City=* | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | inputlookup append=t previously_seen_provisioning_activity_src.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by City | eval newCity=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) | where newCity=1 | table City] | spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, City, eventName, errorCode
|
|
|
|
|
|
### ESCU INVESTIGATIONS ###
|
|
|
|
[ESCU - AWS Investigate User Activities By ARN]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = investigative
|
|
action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN
|
|
description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
|
|
action.escu.creation_date = 2018-01-22
|
|
action.escu.modification_date = 2019-04-30
|
|
action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications"]
|
|
action.escu.earliest_time_offset = 3600
|
|
action.escu.latest_time_offset = 86400
|
|
action.escu.providing_technologies = ["AWS"]
|
|
action.escu.eli5 = none
|
|
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
|
|
action.escu.known_false_positives = None at this time
|
|
action.escu.fields_required = ["user"]
|
|
disabled=true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = | search sourcetype=aws:cloudtrail userIdentity.arn={user} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
|
|
|
|
|
|
|
|
[ESCU - Add Prohibited Processes to Enterprise Security]
|
|
action.escu = 0
|
|
action.escu.enabled = 1
|
|
action.escu.search_type = support
|
|
action.escu.full_search_name = ESCU - Add Prohibited Processes to Enterprise Security
|
|
description = This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.
|
|
action.escu.creation_date = 2017-06-27
|
|
action.escu.modification_date = 2017-09-15
|
|
action.escu.analytic_story = ["Emotet Malware (DHS Report TA18-201A)", "Monitor for Unauthorized Software", "SamSam Ransomware"]
|
|
action.escu.data_models = []
|
|
dispatch.earliest_time = -30d@d
|
|
dispatch.latest_time = -10m@m
|
|
action.escu.providing_technologies = ["Splunk Enterprise Security"]
|
|
action.escu.eli5 = This search outputs the interesting processes lookup table and filters out all processes in the table that haven't already been inserted by ESCU. It then appends to those results all the processes currently identified by ESCU that should be prohibited. Next, it fills in the required fields with processes identified by ESCU, and then writes the results back to the interesting process lookup table. This is done so any new processes identified that should be prohibited will be added to the lookup table without creating any duplicate entries.
|
|
action.escu.how_to_implement = This search should be run on each new install of ESCU.
|
|
action.escu.known_false_positives =
|
|
disabled=true
|
|
schedule_window = auto
|
|
is_visible = false
|
|
search = | inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count
|