Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Rule Tuning] Add Investigation Fields to Specific AWS Rules #4261

Merged
merged 7 commits into from
Nov 9, 2024
Merged

[Rule Tuning] Add Investigation Fields to Specific AWS Rules #4261

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7392b87
adding investigation fields to specific aws rules
terrancedejesus Nov 7, 2024
22d6785
updated patch
terrancedejesus Nov 7, 2024
972c775
removing min-stack requirements
terrancedejesus Nov 8, 2024
7974922
removed user.name redundancy
terrancedejesus Nov 8, 2024
09d8186
adjusted order of investigation fields
terrancedejesus Nov 8, 2024
836a812
adding source address
terrancedejesus Nov 8, 2024
5d91669
Merge branch 'main' into rule-tuning-aws-add-investigation-fields
terrancedejesus Nov 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion detection_rules/etc/non-ecs-schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@
"aws.cloudtrail.flattened.request_parameters.fromPort": "keyword",
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword",
"aws.cloudtrail.flattened.request_parameters.roleName": "keyword",
"aws.cloudtrail.flattened.request_paramters.policyArn": "keyword",
"aws.cloudtrail.flattened.request_parameters.policyArn": "keyword",
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword"
},
"logs-azure.signinlogs-*": {
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "detection_rules"
version = "0.1.3"
version = "0.1.4"
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
readme = "README.md"
requires-python = ">=3.12"
Expand Down
23 changes: 22 additions & 1 deletion rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
creation_date = "2022/09/03"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2024/09/23"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -87,6 +89,25 @@ and process.args: (
)
'''

[rule.investigation_fields]
field_names = [
"@timestamp",
"cloud.region",
"event.type",
"host.os.type",
"host.os.kernel",
"process.entry_leader.executable",
"process.entry_leader.group.name",
"process.entry_leader.real_user.name",
"process.entry_leader.working_directory",
"process.parent.executable",
"process.executable",
"process.hash.sha256",
"process.parent.command_line",
"process.command_line",
"process.args",
"process.user.name"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
23 changes: 21 additions & 2 deletions rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
creation_date = "2020/05/26"
integration = ["aws"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -86,9 +88,26 @@ timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:DeleteTrail and event.outcome:success
event.dataset:aws.cloudtrail
and event.provider:cloudtrail.amazonaws.com
and event.action:DeleteTrail
and event.outcome:success
'''

[rule.investigation_fields]
field_names = [
"event.action",
"event.outcome",
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
"cloud.region",
"user_agent.original",
"user.name",
"related.user",
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
"source.address",
"aws.cloudtrail.request_parameters",
"aws.cloudtrail.flattened.request_parameters.name",
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
"aws.cloudtrail.user_identity.type",
"aws.cloudtrail.user_identity.arn"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
11 changes: 10 additions & 1 deletion rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
creation_date = "2024/08/26"
integration = ["aws"]
maturity = "production"
updated_date = "2024/11/05"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -107,6 +109,13 @@ from logs-aws.cloudtrail-*
| sort target_time_window desc
'''

[rule.investigation_fields]
field_names = [
"region_count",
"window_count",
"target_time_window",
"aws.cloudtrail.user_identity.arn"
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
8 changes: 7 additions & 1 deletion rules/integrations/aws/discovery_ec2_multiple_discovery_api_calls_via_cli.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["aws"]
maturity = "production"
min_stack_comments = "ES|QL rule type is still in technical preview as of 8.13, however this rule was tested successfully"
min_stack_version = "8.13.0"
updated_date = "2024/11/04"
updated_date = "2024/11/07"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -133,6 +133,12 @@ from logs-aws.cloudtrail*
| sort unique_api_count desc
'''

[rule.investigation_fields]
field_names = [
"time_window",
"aws.cloudtrail.user_identity.arn",
"unique_api_count"
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
31 changes: 23 additions & 8 deletions rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,21 @@
creation_date = "2024/05/24"
integration = ["aws"]
maturity = "production"
updated_date = "2024/09/30"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic"]
description = """
An adversary with access to a set of compromised credentials may attempt to verify that the credentials are valid and
determine what account they are using. This rule looks for the first time an identity has called the
STS `GetCallerIdentity` API operation in the last 15 days, which may be an indicator of compromised credentials.
An adversary with access to a set of compromised credentials may attempt to verify that the credentials are valid and
determine what account they are using. This rule looks for the first time an identity has called the
STS `GetCallerIdentity` API operation in the last 15 days, which may be an indicator of compromised credentials.
A legitimate user would not need to call this operation as they should know the account they are using.
"""
false_positives = [
"""
Verify whether the user identity should be using the STS `GetCallerIdentity` API operation.
Verify whether the user identity should be using the STS `GetCallerIdentity` API operation.
If known behavior is causing false positives, it can be exempted from the rule.
""",
]
Expand All @@ -29,7 +31,7 @@ note = """## Triage and analysis
### Investigating AWS GetCallerIdentity API Called for the First Time

AWS Security Token Service (AWS STS) is a service that enables you to request temporary, limited-privilege credentials for users.
The `GetCallerIdentity` function returns details about the IAM user or role owning the credentials used to call the operation.
The `GetCallerIdentity` function returns details about the IAM user or role owning the credentials used to call the operation.
No permissions are required to run this operation and the same information is returned even when access is denied.
This rule looks for use of the `GetCallerIdentity` operation. This is a [New Terms](https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has called this operation within the last 15 days.

Expand Down Expand Up @@ -93,10 +95,23 @@ timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset: "aws.cloudtrail" and event.provider: "sts.amazonaws.com" and event.action: "GetCallerIdentity"
and not aws.cloudtrail.user_identity.type: "AssumedRole"
event.dataset: "aws.cloudtrail"
and event.provider: "sts.amazonaws.com"
and event.action: "GetCallerIdentity"
and event.outcome: "success"
and not aws.cloudtrail.user_identity.type: "AssumedRole"
'''

[rule.investigation_fields]
field_names = [
"event.action",
"event.outcome",
"cloud.region",
"user_agent.original",
"user.name",
"aws.cloudtrail.user_identity.type",
"aws.cloudtrail.user_identity.arn"
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
32 changes: 25 additions & 7 deletions rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,29 @@
creation_date = "2024/11/01"
integration = ["aws"]
maturity = "production"
updated_date = "2024/11/01"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic"]
description = """
Identifies when an AWS Systems Manager (SSM) command document is created by a user who does not typically perform this action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, data exfiltration and more.
Identifies when an AWS Systems Manager (SSM) command document is created by a user who does not typically perform this
action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to
unauthorized access, command and control, data exfiltration and more.
"""
false_positives = [
"""
Legitimate users may create SSM command documents for legitimate purposes. Ensure that the document is authorized and the user is known before taking action.
Legitimate users may create SSM command documents for legitimate purposes. Ensure that the document is authorized
and the user is known before taking action.
""",
]
from = "now-9m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS SSM Command Document Created by Rare User"
note = """
## Triage and Analysis
note = """## Triage and Analysis

### Investigating AWS SSM Command Document Created by Rare User

Expand Down Expand Up @@ -55,7 +59,7 @@ For further guidance on managing and securing AWS Systems Manager in your enviro
"""
references = [
"https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateDocument.html",
"https://docs.aws.amazon.com/systems-manager/latest/userguide/documents.html"
"https://docs.aws.amazon.com/systems-manager/latest/userguide/documents.html",
]
risk_score = 21
rule_id = "50a2bdea-9876-11ef-89db-f661ea17fbcd"
Expand All @@ -68,7 +72,7 @@ tags = [
"Data Source: AWS Systems Manager",
"Resources: Investigation Guide",
"Use Case: Threat Detection",
"Tactic: Execution"
"Tactic: Execution",
]
timestamp_override = "event.ingested"
type = "new_terms"
Expand All @@ -81,6 +85,20 @@ event.dataset: "aws.cloudtrail"
and aws.cloudtrail.response_elements: *documentType=Command*
'''

[rule.investigation_fields]
field_names = [
"event.action",
"event.outcome",
"cloud.region",
"related.user",
"user.name",
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
"user_agent.original",
"aws.cloudtrail.request_parameters",
"aws.cloudtrail.response_elements",
"aws.cloudtrail.user_identity.arn",
"aws.cloudtrail.user_identity.type"
]

[[rule.threat]]
framework = "MITRE ATT&CK"

Expand Down
18 changes: 17 additions & 1 deletion rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
creation_date = "2024/11/01"
integration = ["aws"]
maturity = "production"
updated_date = "2024/11/01"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -81,6 +83,20 @@ event.dataset: "aws.cloudtrail"
and aws.cloudtrail.request_parameters: *protocol=email*
'''

[rule.investigation_fields]
field_names = [
"event.action",
"event.outcome",
"cloud.region",
"user_agent.original",
"user.name",
"aws.cloudtrail.request_parameters",
"aws.cloudtrail.flattened.request_parameters.protocol",
"aws.cloudtrail.flattened.request_parameters.topicArn",
"aws.cloudtrail.flattened.response_elements.subscriptionArn",
"aws.cloudtrail.user_identity.type",
"aws.cloudtrail.user_identity.arn"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
9 changes: 8 additions & 1 deletion rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2024/05/01"
maturity = "production"
updated_date = "2024/10/09"
updated_date = "2024/11/07"
min_stack_comments = "ES|QL rule type is still in technical preview as of 8.13, however this rule was tested successfully"
min_stack_version = "8.13.0"

Expand Down Expand Up @@ -97,6 +97,13 @@ from logs-aws.cloudtrail*
| where failed_requests > 40
'''

[rule.investigation_fields]
field_names = [
"failed_requests",
"tls.client.server_name",
"source.address",
"cloud.account.id"
]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have no way of showing the actor for this? Both for the rule and the higlighted fields? Or is this rule only interested in the details of the bucket itself?

Copy link
Contributor Author

@terrancedejesus terrancedejesus Nov 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can only show the fields available after the aggregation unfortunately. You could add source.address to timeline then add the event.action and find out, but in the alert document, it would not be there.


[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
21 changes: 20 additions & 1 deletion rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
creation_date = "2021/05/05"
integration = ["aws"]
maturity = "production"
updated_date = "2024/11/05"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic", "Austin Songer"]
Expand Down Expand Up @@ -100,6 +102,23 @@ event.dataset: "aws.cloudtrail"
and event.outcome: "success"
'''

[rule.investigation_fields]
field_names = [
"@timestamp",
"cloud.region",
"event.provider",
"event.action",
"event.outcome",
"related.user",
"user_agent.original",
"user.name",
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
"aws.cloudtrail.request_parameters",
"aws.cloudtrail.response_elements",
"aws.cloudtrail.flattened.request_parameters.instanceId",
"aws.cloudtrail.user_identity.arn",
"aws.cloudtrail.user_identity.type"
]


[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
17 changes: 16 additions & 1 deletion rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
creation_date = "2024/11/04"
integration = ["aws"]
maturity = "production"
updated_date = "2024/11/04"
updated_date = "2024/11/07"
min_stack_comments = "New fields added: investigation_fields"
min_stack_version = "8.11.0"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -96,6 +98,19 @@ event.dataset: "aws.cloudtrail"
and aws.cloudtrail.user_identity.arn: *i-*
'''

[rule.investigation_fields]
field_names = [
"event.action",
"event.outcome",
"cloud.region",
"related.user",
"user_agent.original",
"user.name",
"aws.cloudtrail.request_parameters",
"aws.cloudtrail.response_elements",
"aws.cloudtrail.user_identity.arn",
"aws.cloudtrail.user_identity.type"
terrancedejesus marked this conversation as resolved.
Show resolved Hide resolved
]

[[rule.threat]]
framework = "MITRE ATT&CK"
Expand Down
Loading
Loading