[Rule Tunings] AWS Route 53 Rules

[imays11]

Pull Request

Issue link(s):

• https://github.com/elastic/ia-trade-team/issues/616

Summary - What I changed

AWS Route53 Domain Transfer Lock Disabled and AWS Route53 Domain Transferred to Another Account were not alertingas expected due to an error in the event.provider field: (route53.amazonaws.com vs route53domains.amazonaws.com). This has been adjusted and I updated the rules in our stack in order to fully test them. I will continue to monitor these rules in telemetry moving forward to see how they perform as we currently have no existing data for them due to this error.

AWS Route53 Private Hosted Zone Associated With a VPC and AWS Route53 Resolver Query Log Configuration Deleted are performing well in telemetry, low volume as expected.

---

AWS Route53 Domain Transfer Lock Disabled

• increased rule severity to high (this is a rare and high severity activity if unauthorized)
• corrected event.provider value in query
• updated title
• updated Description, FP and IG sections
• reduced execution window
• added highlighted fields
• updated Mitre

AWS Route53 Domain Transferred to Another Account

• increased rule severity to high (this is a rare and high severity activity if unauthorized)
• corrected event.provider value in query
• updated title
• updated Description, FP and IG sections
• reduced execution window
• added highlighted fields
• updated Mitre

AWS Route53 Private Hosted Zone Associated With a VPC

• increased rule severity to medium
• corrected event.provider value in query
• updated title
• updated Description, FP and IG sections
• reduced execution window
• added highlighted fields
• updated Mitre

AWS Route53 Resolver Query Log Configuration Deleted

• updated title
• updated Description, FP and IG sections
• reduced execution window
• updated tags
• added highlighted fields

How To Test

• Domain Transfer rules: AWS Route53 Domain Transfer Lock Disabled, AWS Route53 Domain Transferred to Another Account : trigger_persistence_route53_domain_transfer_rules.py
  • Note : This script will successfully disable Domain Transfer Lock and attempt to Transfer the Domain to an external Account. I created a new Domain, but was unable to successfully test the Domain Transfer event because new Domains in AWS are not eligible for transfer within the first 60 days of creation. Instead I adjusted the existing rule in the stack to alert for failed attempts as well, so I was still able to test the rest of the rule logic using this same script.

These scripts will trigger the other 2 rules as expected

• trigger_defense_evasion_route53_dns_query_resolver_config_deletion.py
• trigger_persistence_route_53_hosted_zone_associated_with_a_vpc.py

Test data is in the stack for running the queries against.

[github-actions]

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

• Detailed description of the suggested changes.
• Provide example JSON data or screenshots.
• Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
• Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
• Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
• Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
• Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
• Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
• Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
• Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
• Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
• Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

• updated_date matches the date of tuning PR merged.
• min_stack_version should support the widest stack versions.
• name and description should be descriptive and not include typos.
• query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

• Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
• Ensure that the tuned rule has a low false positive rate.