splunk-security_content/dist/devsecops/default/savedsearches.conf

#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

### ESCU DETECTIONS ###

[ESCU - AWS ECR Container Scanning Findings High - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings High
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` | collect index=findings

[ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings Low Informational Unknown
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter` | collect index=findings

[ESCU - AWS ECR Container Scanning Findings Medium - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Medium - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Medium - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
action.notable.param.rule_title = AWS ECR Container Scanning Findings Medium
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` | collect index=findings

[ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Container uploaded outside business hours from $user$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
action.notable.param.rule_title = AWS ECR Container Upload Outside Business Hours
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.* as * | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repositoryName, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter` | collect index=findings

[ESCU - AWS ECR Container Upload Unknown User - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS ECR Container Upload Unknown User - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Container uploaded from unknown user $user$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS ECR Container Upload Unknown User - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
action.notable.param.rule_title = AWS ECR Container Upload Unknown User
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users` | rename requestParameters.* as * | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repositoryName, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_unknown_user_filter` | collect index=findings

[ESCU - AWS Excessive Security Scanning - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
action.escu.known_false_positives = While this search has no known false positives.
action.escu.creation_date = 2021-04-13
action.escu.modification_date = 2021-04-13
action.escu.confidence = high
action.escu.full_search_name = ESCU - AWS Excessive Security Scanning - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["AWS User Monitoring"]
action.risk = 1
action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50,  using the following commands $command$.
action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - AWS Excessive Security Scanning - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter` | collect index=findings

[ESCU - GSuite Email Suspicious Attachment - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
action.escu.creation_date = 2021-08-16
action.escu.modification_date = 2021-08-16
action.escu.confidence = high
action.escu.full_search_name = ESCU - GSuite Email Suspicious Attachment - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - GSuite Email Suspicious Attachment - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
action.notable.param.rule_title = GSuite Email Suspicious Attachment
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments  subject destination{}.address source.address phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_attachment_filter` | collect index=findings

[ESCU - Gsuite Drive Share In External Email - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin or normal user may share files to customer and external team.
action.escu.creation_date = 2021-08-16
action.escu.modification_date = 2021-08-16
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Drive Share In External Email - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Drive Share In External Email - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
action.notable.param.rule_title = Gsuite Drive Share In External Email
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)" | rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter` | collect index=findings

[ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
action.escu.creation_date = 2021-08-19
action.escu.modification_date = 2021-08-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 25}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
action.notable.param.rule_title = Gsuite Email Suspicious Subject With Attachment
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments  subject destination{}.address source.address plan | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_subject_with_attachment_filter` | collect index=findings

[ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
action.escu = 0
action.escu.enabled = 1
description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 25}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
action.notable.param.rule_title = Gsuite Email With Known Abuse Web Service Link
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter` | collect index=findings

[ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
action.escu.creation_date = 2021-08-17
action.escu.modification_date = 2021-08-17
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
action.notable.param.rule_title = Gsuite Outbound Email With Attachment To External Domain
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" | eval phase="plan" | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime by dest_domain phase | where numSrcAddresses < 20 |sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_outbound_email_with_attachment_to_external_domain_filter` | collect index=findings

[ESCU - Gsuite Suspicious Shared File Name - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
action.escu.data_models = []
action.escu.eli5 = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite Suspicious Shared File Name - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["DevSecOps"]
action.risk = 1
action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Gsuite Suspicious Shared File Name - Rule
action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.rule_description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
action.notable.param.rule_title = Gsuite Suspicious Shared File Name
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter` | collect index=findings

[ESCU - Kubernetes Nginx Ingress LFI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-20
action.escu.modification_date = 2021-08-20
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress LFI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Local File Inclusion Attack detected on $host$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress LFI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
action.notable.param.rule_title = Kubernetes Nginx Ingress LFI
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter` | collect index=findings

[ESCU - Kubernetes Nginx Ingress RFI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-23
action.escu.modification_date = 2021-08-23
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress RFI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Remote File Inclusion Attack detected on $host$
action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress RFI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
action.notable.param.rule_title = Kubernetes Nginx Ingress RFI
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter` | collect index=findings

[ESCU - Kubernetes Scanner Image Pulling - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2021-08-24
action.escu.modification_date = 2021-08-24
action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes Scanner Image Pulling - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Kubernetes Scanner image pulled on host $host$
action.risk.param._risk = [{"threat_object_field": "host", "threat_object_type": "entity"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Kubernetes Scanner Image Pulling - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "host", "type": "Entity"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
action.notable.param.rule_title = Kubernetes Scanner Image Pulling
action.notable.param.security_domain = network
action.notable.param.severity = high
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host | eval phase="operate" | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter` | collect index=findings

### END ESCU DETECTIONS ###


### ESCU BASELINES ###



### ESCU RESPONSE TASKS ###



### END ESCU RESPONSE TASKS ###

### USAGE DASHBOARD CONFIGURATIONS ###

[escu-metrics-usage]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

[escu-metrics-search]
action.email.useNSSubject = 1
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)

[escu-metrics-search-events]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")

[escu-metrics-search-longest-runtime]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
disabled = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id

[escu-metrics-usage-search]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
enableSched = 1
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

### END OF USAGE DASHBOARD CONFIGURATIONS ###