new anomaly detection

detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml

@@ -0,0 +1,59 @@
+name: AWS Exfiltration via Anomalous GetObject API Activity
+id: e4384bbf-5835-4831-8d85-694de6ad2cc6
+version: 1
+date: '2023-04-10'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making GetObject API calls to download objects from S3. 
+search: '`cloudtrail` eventName=GetObject | bin _time span=10m |  stats count values(requestParameters.bucketName) as bucketName by _time user_type user_arn userIdentity.principalId
+| anomalydetection "count" "user_type" "user_arn" action=annotate | `aws_exfiltration_via_anomalous_getobject_api_activity_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: It is possible that a user downloaded these files to use them locally.
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+tags:
+  analytic_story:
+  - Data Exfiltration
+  asset_type: AWS Account
+  confidence: 80
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail.json
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Anomalous S3 activities detected by user $user_arn$ 
+  mitre_attack_id:
+  - T1119
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: aws_account_id
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - user_arn
+  - src_ip
+  - aws_account_id
+  - userAgent
+  - userIdentity.principalId
+  risk_score: 64
+  security_domain: threat

detections/cloud/aws_exfiltration_via_datasync_task.yml

@@ -15,7 +15,7 @@ references:
 tags:
   analytic_story:
   - Data Exfiltration
-  asset_type: EC2 Snapshot
+  asset_type: AWS Account
   confidence: 80
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json