splunk-security_content/dist/devsecops/default/use_case_library.conf

#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-27T14:41:52 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

### STORIES ###

[analytic_story://Dev Sec Ops]
category = Cloud Security
last_updated = 2021-08-18
version = 1
references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
spec_version = 3
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.

### END STORIES ###

### DETECTIONS ###

[savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

[savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

[savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

[savedsearch://ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
providing_technologies = []

[savedsearch://ESCU - AWS ECR Container Upload Unknown User - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

[savedsearch://ESCU - AWS Excessive Security Scanning - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives.
providing_technologies = []

[savedsearch://ESCU - GSuite Email Suspicious Attachment - Rule]
type = detection
asset_type = 
confidence = medium
explanation = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
providing_technologies = []

[savedsearch://ESCU - Gsuite Drive Share In External Email - Rule]
type = detection
asset_type = 
confidence = medium
explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
known_false_positives = network admin or normal user may share files to customer and external team.
providing_technologies = []

[savedsearch://ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
type = detection
asset_type = 
confidence = medium
explanation = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
providing_technologies = []

[savedsearch://ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
type = detection
asset_type = 
confidence = medium
explanation = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
providing_technologies = []

[savedsearch://ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
type = detection
asset_type = 
confidence = medium
explanation = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
providing_technologies = []

[savedsearch://ESCU - Gsuite Suspicious Shared File Name - Rule]
type = detection
asset_type = 
confidence = medium
explanation = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
providing_technologies = []

[savedsearch://ESCU - Kubernetes Nginx Ingress LFI - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

[savedsearch://ESCU - Kubernetes Nginx Ingress RFI - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

[savedsearch://ESCU - Kubernetes Scanner Image Pulling - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []

### END DETECTIONS ###

### RESPONSE TASKS ###

### END RESPONSE TASKS ###