Skip to content

Commit a5f1973

Browse files
author
jcbrewer5D6400
authored
Merge pull request #268 from splunk/CRL-1645
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by…
2 parents 92078c2 + 322e711 commit a5f1973

File tree

5 files changed

+174
-1
lines changed

5 files changed

+174
-1
lines changed

‎baselines/train_ec2_excessive_terminateinstances.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
baseline:
2+
splunk:
3+
macros:
4+
- ec2_excessive_terminateinstances_mltk_input_filter
5+
schedule:
6+
cron_schedule: ''
7+
earliest_time: -91d@d
8+
latest_time: -1d@d
9+
search: >-
10+
sourcetype=aws:cloudtrail eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
11+
| bucket span=10m _time
12+
| stats count as instances_terminated by _time src_user
13+
| fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1
14+
creation_date: '2019-11-14'
15+
data_metadata:
16+
data_source:
17+
- AWS CloudTrail logs
18+
data_sourcetypes:
19+
- aws:cloudtrail
20+
providing_technologies:
21+
- AWS
22+
description: This search is used to build a Machine Learning Toolkit (MLTK) model
23+
for how many TerminateInstances users do in the environment. By default, the search
24+
uses the last 90 days of data to build the model. The model created by this search
25+
is then used in the corresponding detection search, which identifies subsequent
26+
outliers in the number of TerminateInstances performed by a user in a small time window.
27+
eli5: Create a machine-learning (ML) model to establish a baseline for how many
28+
TerminateInstances users do in the environment. This can help you identify excessive
29+
numbers of TerminateInstances which may warrant further investigation to determine if there
30+
is misuse or abuse.
31+
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
32+
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
33+
inputs.\
34+
35+
In addition, you must have the Machine Learning Toolkit (MLTK) version
36+
>= 4.2 installed, along with any required dependencies. Depending on the number
37+
of users in your environment, you may also need to adjust the value for max_inputs
38+
in the MLTK settings for the DensityFunction algorithm, then ensure that the search
39+
completes in a reasonable timeframe. By default, the search builds the model using
40+
the past 30 days of data. You can modify the search window to build the model over
41+
a longer period of time, which may give you better results. You may also want to
42+
periodically re-run this search to rebuild the model with the latest data.\
43+
44+
More information on the algorithm used in the search can be found at
45+
`https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
46+
id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
47+
known_false_positives: ''
48+
maintainers:
49+
- company: Splunk
50+
email: [email protected]
51+
name: Jason Brewer
52+
modification_date: '2019-11-14'
53+
name: Baseline of Excessive AWS Instances Terminated by User - MLTK
54+
original_authors:
55+
- company: Splunk
56+
email: [email protected]
57+
name: Jason Brewer
58+
spec_version: 2
59+
type: splunk
60+
version: '1.0'

‎detections/ec2_excessive_terminateinstances_mltk.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
asset_type: AWS Instance
2+
baselines:
3+
- id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
4+
name: Baseline of Excessive AWS Instances Terminated by User - MLTK
5+
type: splunk
6+
confidence: medium
7+
creation_date: '2019-11-14'
8+
data_metadata:
9+
data_source:
10+
- AWS CloudTrail logs
11+
data_sourcetypes:
12+
- aws:cloudtrail
13+
providing_technologies:
14+
- AWS
15+
description: This search looks for CloudTrail events where a user successfully terminates
16+
an abnormally high number of instances.
17+
detect:
18+
splunk:
19+
correlation_rule:
20+
macros:
21+
- ec2_excessive_terminateinstances_mltk_input_filter
22+
notable:
23+
nes_fields: src_user
24+
rule_description: An abnormally high number of instances were terminated by
25+
a user within in a 10-minute window
26+
rule_title: High Number of instances terminated by $src_user$
27+
risk:
28+
risk_object: src_user
29+
risk_object_type:
30+
- user
31+
risk_score: 30
32+
schedule:
33+
cron_schedule: '*/10 * * * *'
34+
earliest_time: -70m@m
35+
latest_time: -10m@m
36+
search: >-
37+
sourcetype=aws:cloudtrail eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
38+
| bucket span=10m _time
39+
| stats count as instances_terminated by _time src_user
40+
| apply ec2_excessive_terminateinstances_v1
41+
| rename "IsOutlier(instances_terminated)" as isOutlier
42+
| where isOutlier=1
43+
suppress:
44+
suppress_fields: src_user
45+
suppress_period: 3600s
46+
eli5: In this search, we query CloudTrail logs to look for events where an instance
47+
is successfully terminated by a particular user. Since we want to detect a high number
48+
of instances terminated within a short period, we create event buckets for 10-minute
49+
windows. We then compare the total number of instances terminated by a particular
50+
user against the saved baseline data in the model ec2_excessive_terminateinstances_v1.
51+
entities:
52+
- src_user
53+
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
54+
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
55+
inputs. The threshold value should be tuned to your environment.
56+
id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e
57+
investigations:
58+
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
59+
name: AWS Investigate User Activities By ARN
60+
type: splunk
61+
- id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
62+
name: Get EC2 Launch Details
63+
type: splunk
64+
- id: f3db4d1b-5f33-4b01-c541-c7ah9514c242
65+
name: Get EC2 Instance Details by instanceId
66+
type: splunk
67+
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
68+
name: Get Notable History
69+
type: splunk
70+
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
71+
name: Get Notable Info
72+
type: splunk
73+
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
74+
name: Get User Information from Identity Table
75+
type: splunk
76+
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
77+
name: Investigate AWS activities via region name
78+
type: splunk
79+
known_false_positives: Many service accounts configured within an AWS infrastructure
80+
are known to exhibit this behavior. Please adjust the threshold values and filter
81+
out service accounts from the output. Always verify if this search alerted on a
82+
human user.
83+
maintainers:
84+
- company: Splunk
85+
email: [email protected]
86+
name: Jason Brewer
87+
mappings:
88+
cis20:
89+
- CIS 13
90+
kill_chain_phases:
91+
- Actions on Objectives
92+
mitre_attack:
93+
- Execution
94+
nist:
95+
- DE.DP
96+
- DE.AE
97+
modification_date: '2019-11-14'
98+
name: Abnormally High AWS Instances Terminated by User - MLTK
99+
original_authors:
100+
- company: Splunk
101+
email: [email protected]
102+
name: Jason Brewer
103+
references: []
104+
security_domain: network
105+
spec_version: 2
106+
type: splunk
107+
version: '1.0'

‎macros/ec2_excessive_runinstances_mltk_input_filter.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
description: Use this macro to add additional filters for monitoring ec2
2-
runinstances [eg - userName != 'someUserNameExperiencingFalsePositives'].
2+
runinstances [eg - src_user != 'someUserNameExperiencingFalsePositives'].
33
name: ec2_excessive_runinstances_mltk_input_filter

‎macros/ec2_excessive_terminateinstances_mltk_input_filter.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
description: Use this macro to add additional filters for monitoring ec2
2+
terminateinstances [eg - src_user != 'someUserNameExperiencingFalsePositives'].
3+
name: ec2_excessive_terminateinstances_mltk_input_filter

‎stories/aws_ec2.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ detections:
2323
- detection_id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5
2424
name: Abnormally High AWS Instances Launched by User - MLTK
2525
type: splunk
26+
- detection_id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e
27+
name: Abnormally High AWS Instances Terminated by User - MLTK
28+
type: splunk
2629
id: 2e8948a5-5239-406b-b56b-6c50f1268af3
2730
maintainers:
2831
- company: Splunk

0 commit comments

Comments
 (0)