Skip to content

Commit 77cbb83

Browse files
author
Patrick Bareiss
committed
Merge branch 'develop' into github_detections_improvement
2 parents 0c12b68 + c795cda commit 77cbb83

File tree

54 files changed

+2092
-235
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+2092
-235
lines changed
Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Baseline Of Open S3 Bucket Decommissioning
2+
id: 984e9022-b87b-499a-a260-8d0282c46ea2
3+
version: 1
4+
date: '2025-02-12'
5+
author: Jose Hernandez
6+
type: Baseline
7+
status: production
8+
description: |-
9+
The following analytic identifies S3 buckets that were previously exposed to the public and have been subsequently deleted. It leverages AWS CloudTrail logs to track the lifecycle of potentially risky S3 bucket configurations. This activity is crucial for ensuring that public access to sensitive data is properly managed and decommissioned. By monitoring these events, organizations can ensure that exposed buckets are promptly deleted, reducing the risk of unauthorized access. Immediate investigation is recommended to confirm the proper decommissioning of these buckets and to ensure no sensitive data remains exposed. This baseline detection creates a lookup table of decommissioned buckets.csv and their associated events which can be used by detection searches to trigger alerts when decommissioned buckets are detected.
10+
11+
The following detections searches leverage this baseline search and the lookup table.
12+
* Detect DNS Query to Decommissioned S3 Bucket
13+
* Detect Web Access to Decommissioned S3 Bucket
14+
search: '`cloudtrail` eventSource="s3.amazonaws.com" (eventName=DeleteBucket OR eventName=PutBucketPolicy OR eventName=PutBucketWebsite)
15+
| spath input=_raw path=requestParameters.bucketName output=bucketName
16+
| spath input=_raw path=requestParameters.Host output=host
17+
| spath input=_raw path=requestParameters.bucketPolicy.Statement{} output=statements
18+
| spath input=statements output=principal path=Principal
19+
| spath input=statements output=effect path=Effect
20+
| spath input=statements output=action path=Action
21+
| stats values(eventName) as events,
22+
values(requestParameters.bucketPolicy) as policies,
23+
values(principal) as principals,
24+
values(effect) as effects,
25+
values(action) as actions,
26+
min(_time) as firstEvent,
27+
max(_time) as lastEvent,
28+
values(userIdentity.accountId) as accountIds,
29+
values(userIdentity.arn) as userARNs,
30+
values(awsRegion) as awsRegions,
31+
values(host) as hosts
32+
by bucketName
33+
| eval isPublicPolicy = if( (mvfind(principals, "\\*")>=0) AND (mvfind(effects, "Allow")>=0) AND (mvfind(actions, "s3:GetObject")>=0), 1, 0)
34+
| eval isWebsite = if(mvfind(events, "PutBucketWebsite")>=0, 1, 0)
35+
| eval is_open = if(isPublicPolicy==1 OR isWebsite==1, 1, 0)
36+
| where is_open==1 AND (mvfind(events, "DeleteBucket")>=0)
37+
| eval policy_details = if(isPublicPolicy==1, "Policy: Principal=" . mvjoin(principals, ", ") . " Effect=" . mvjoin(effects, ", ") . " Action=" . mvjoin(actions, ", "), "No Public Policy")
38+
| eval website_details = if(isWebsite==1, "Static Website Enabled", "No Website Hosting")
39+
| table bucketName, hosts, firstEvent, lastEvent, events, policy_details, website_details, accountIds, userARNs, awsRegions
40+
| outputlookup append=true decommissioned_buckets | `baseline_of_open_s3_bucket_decommissioning_filter`'
41+
how_to_implement: To implement this baseline, you need to have AWS CloudTrail logs being ingested into Splunk with the AWS Add-on properly configured. The search looks for S3 bucket events related to bucket policies, website hosting configuration, and bucket deletion. The results are stored in a lookup KVStore named decommissioned_buckets which tracks the history of deleted buckets that were previously exposed to the public.
42+
known_false_positives: Some buckets may be intentionally made public for legitimate business purposes before being decommissioned. Review the policy_details and website_details fields to understand the nature of the public access that was configured.
43+
references:
44+
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
45+
- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
46+
- https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
47+
tags:
48+
analytic_story:
49+
- AWS S3 Bucket Security Monitoring
50+
- Suspicious AWS S3 Activities
51+
product:
52+
- Splunk Enterprise
53+
- Splunk Enterprise Security
54+
- Splunk Cloud
55+
detections:
56+
- Detect DNS Query to Decommissioned S3 Bucket
57+
- Detect Web Access to Decommissioned S3 Bucket
58+
security_domain: audit
59+
deployment:
60+
scheduling:
61+
cron_schedule: 0 2 * * 0
62+
earliest_time: -30d@d
63+
latest_time: -1d@d
64+
schedule_window: auto

contentctl.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ apps:
4141
version: 3.0.0
4242
description: description of app
4343
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_300.tgz
44+
- uid: 7404
45+
title: Cisco Security Cloud
46+
appid: CiscoSecurityCloud
47+
version: 3.0.1
48+
description: description of app
49+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_301.tgz
4450
- uid: 6652
4551
title: Add-on for Linux Sysmon
4652
appid: Splunk_TA_linux_sysmon
@@ -77,9 +83,9 @@ apps:
7783
- uid: 5579
7884
title: Splunk Add-on for CrowdStrike FDR
7985
appid: Splunk_TA_CrowdStrike_FDR
80-
version: 2.0.4
86+
version: 2.0.3
8187
description: description of app
82-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_204.tgz
88+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_203.tgz
8389
- uid: 3185
8490
title: Splunk Add-on for Microsoft IIS
8591
appid: SPLUNK_TA_FOR_IIS
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Cisco AI Defense Alerts
2+
id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e
3+
version: 1
4+
date: '2024-07-18'
5+
author: Bhavin Patel
6+
description: Data source object for Cisco AI Defense Alerts
7+
source: cisco_ai_defense
8+
sourcetype: cisco:ai:defense
9+
separator:
10+
supported_TA:
11+
- name: Cisco Security Cloud
12+
url: https://splunkbase.splunk.com/app/7404
13+
version: 3.0.1
14+
fields:
Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Cisco AI Defense Security Alerts by Application Name
2+
id: 105e4a69-ec55-49fc-be1f-902467435ea8
3+
version: 1
4+
date: '2025-02-14'
5+
author: Bhavin Patel, Splunk
6+
status: experimental
7+
type: Anomaly
8+
description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
9+
data_source:
10+
- Cisco AI Defense Alerts
11+
search: |-
12+
`cisco_ai_defense`
13+
| rename genai_application.application_name as application_name
14+
| rename connection.connection_name as connection_name
15+
```Aggregating data by model name, connection name, application name, application ID, and user ID```
16+
| stats count
17+
values(user_id) as user_id
18+
values(event_message_type) as event_message_type
19+
values(event_action) as event_action
20+
values(policy.policy_name) as policy_name
21+
values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name
22+
values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type
23+
by model.model_name connection_name application_name application_id
24+
```Evaluating severity based on policy name and guardrail ruleset type```
25+
| eval severity=case(
26+
policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical",
27+
policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high",
28+
guardrail_ruleset_type IN ("Toxicity"), "medium",
29+
true(), "low"
30+
)
31+
```Calculating risk score based on severity level```
32+
| eval risk_score=case(
33+
severity="critical", 100,
34+
severity="high", 75,
35+
severity="medium", 50,
36+
severity="low", 25
37+
)
38+
| table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name
39+
|`cisco_ai_defense_security_alerts_by_application_name_filter`'
40+
how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype.
41+
known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
42+
references:
43+
- https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4
44+
- https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html
45+
drilldown_searches:
46+
- name: View risk events for the last 7 days for - "$application_id$"
47+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$application_id$" ) starthoursago=168 | stats count min(_time)
48+
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
49+
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
50+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
51+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
rba:
55+
message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$]
56+
risk_objects:
57+
- field: application_name
58+
type: other
59+
score: 10
60+
threat_objects: []
61+
tags:
62+
analytic_story:
63+
- Critical Alerts
64+
asset_type: Web Application
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense.log
74+
source: cisco_ai_defense
75+
sourcetype: cisco:ai:defense

detections/application/cisco_secure_application_alerts.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ tags:
7979
- Splunk Enterprise Security
8080
- Splunk Cloud
8181
security_domain: threat
82-
# manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty.
82+
manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty.
8383
tests:
8484
- name: True Positive Test
8585
attack_data:
Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: O365 Exfiltration via File Access
2+
id: 80b44ae2-60ff-43f1-8e56-34beb49a340a
3+
version: 1
4+
date: '2024-10-14'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when an excessive number of files are access from o365 by the same user over a short period of time. A malicious actor may abuse the "open in app" functionality of SharePoint through scripted or Graph API based access to evade triggering the FileDownloaded Event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be take with any Azure Guest (#EXT#) accounts.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Operation IN ("fileaccessed") UserId!=app@sharepoint NOT SourceFileExtension IN (bmp,png,jpeg,jpg)
13+
| eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
14+
| where NOT match(SiteUrl,user_flat)
15+
| stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
16+
| eventstats avg(count) as avg stdev(count) as stdev by Workload
17+
| rename SiteUrl as file_path,Workload as app
18+
| where count > 50 AND count > (avg + (3*(stdev)))
19+
| `security_content_ctime(firstTime)`
20+
| `security_content_ctime(lastTime)`
21+
| `o365_exfiltration_via_file_access_filter`
22+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
23+
known_false_positives: It is possible that certain file access scenarios may trigger this alert, specifically OneDrive syncing and users accessing personal onedrives of other users. Adjust threshold and filtering as needed.
24+
references:
25+
- https://attack.mitre.org/techniques/T1567/exfil
26+
- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
27+
- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
28+
drilldown_searches:
29+
- name: View the detection results for - "$user$"
30+
search: '%original_detection_search% | search user = "$user$"'
31+
earliest_offset: $info_min_time$
32+
latest_offset: $info_max_time$
33+
- name: View risk events for the last 7 days for - "$user$"
34+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
- name: Investigate file access by $user$
38+
search: '`o365_management_activity` Operation IN ("fileaccessed") UserId="$UserId$"'
39+
earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
rba:
42+
message: The user $user$ accessed an excessive number of files [$count$] from $file_path$ using $src$
43+
risk_objects:
44+
- field: user
45+
type: user
46+
score: 20
47+
threat_objects:
48+
- field: src
49+
type: ip_address
50+
tags:
51+
analytic_story:
52+
- Data Exfiltration
53+
- Office 365 Account Takeover
54+
asset_type: O365 Tenant
55+
mitre_attack_id:
56+
- T1567
57+
- T1530
58+
product:
59+
- Splunk Enterprise
60+
- Splunk Enterprise Security
61+
- Splunk Cloud
62+
security_domain: threat
63+
tests:
64+
- name: True Positive Test
65+
attack_data:
66+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
67+
source: o365
68+
sourcetype: o365:management:activity
Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: O365 Exfiltration via File Download
2+
id: 06b23921-bfe2-4576-89dd-616f06e129da
3+
version: 1
4+
date: '2024-10-14'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when an excessive number of files are downloaded from o365 by the same user over a short period of time. O365 may bundle these files together as a ZIP file, however each file will have it's own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Operation IN ("filedownloaded")
13+
| eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
14+
| stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
15+
| rename SiteUrl as file_path,Workload as app
16+
| where count > 50
17+
| `security_content_ctime(firstTime)`
18+
| `security_content_ctime(lastTime)`
19+
| `o365_exfiltration_via_file_download_filter`
20+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
21+
known_false_positives: It is possible that certain file download scenarios may trigger this alert, specifically OneDrive syncing. Adjust threshold and filtering as needed.
22+
references:
23+
- https://attack.mitre.org/techniques/T1567/exfil
24+
- https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
25+
- https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
26+
drilldown_searches:
27+
- name: View the detection results for - "$user$"
28+
search: '%original_detection_search% | search user = "$user$"'
29+
earliest_offset: $info_min_time$
30+
latest_offset: $info_max_time$
31+
- name: View risk events for the last 7 days for - "$user$"
32+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: Investigate file downloads by $user$
36+
search: '`o365_management_activity` Operation IN ("filedownloaded") UserId="$UserId$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
rba:
40+
message: The user $user$ downloaded an excessive number of files [$count$] from $file_path$ using $src$
41+
risk_objects:
42+
- field: user
43+
type: user
44+
score: 25
45+
threat_objects:
46+
- field: src
47+
type: ip_address
48+
tags:
49+
analytic_story:
50+
- Data Exfiltration
51+
- Office 365 Account Takeover
52+
asset_type: O365 Tenant
53+
mitre_attack_id:
54+
- T1567
55+
- T1530
56+
product:
57+
- Splunk Enterprise
58+
- Splunk Enterprise Security
59+
- Splunk Cloud
60+
security_domain: threat
61+
tests:
62+
- name: True Positive Test
63+
attack_data:
64+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
65+
source: o365
66+
sourcetype: o365:management:activity

0 commit comments

Comments
 (0)