New Detection for Multi Cloud

Detections/MultipleDataSources/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml

@@ -0,0 +1,106 @@
+id: 1f40ed57-f54b-462f-906a-ac3a89cc90d4
+name: Cross-Cloud Credential Brute Force Attempt
+description: |
+  'This detection focuses on identifying potential cross-cloud brute force attempts involving Azure and AWS platforms. It monitors sign-in activities within the Azure Portal and AWS ConsoleLogins where brute force attempts are successful on both platforms in a synchronized manner.'
+severity: Medium
+requiredDataConnectors:
+  - connectorId: AWS
+    dataTypes:
+      - AWSCloudTrail
+  - connectorId: AzureActiveDirectory
+    dataTypes:
+      - SigninLogs
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
+  - connectorId: MicrosoftThreatProtection
+    dataTypes:
+      - SecurityAlert
+queryFrequency: 1d
+queryPeriod: 1d
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - CredentialAccess
+relevantTechniques:
+  - T1110
+query: |
+  // Materialize a table named "Azure_Bruforce" containing Azure Portal sign-in logs within the last 1 day
+  let Azure_Bruforce =  materialize (
+      SigninLogs
+  // Filter sign-in logs related to the Azure Portal
+        | where AppDisplayName == "Azure Portal"
+  // Exclude entries with empty OriginalRequestId
+      | where isnotempty(OriginalRequestId)
+  // Limit the time range to the last 1 day
+      | where TimeGenerated >= ago(1d)
+  // Summarize various counts and sets based on brute force criteria
+      | summarize 
+          SuccessfulEvent = countif(ResultType == 0), 
+          FailedEvent = countif(ResultType != 0), 
+          totalAzureLoginEventId = dcount(OriginalRequestId), 
+          FailedEventsCount = dcountif(OriginalRequestId, ResultType != 0), 
+          SuccessfuleventsCount = dcountif(OriginalRequestId, ResultType == 0),
+          SetOfFailedevents = makeset(iff(ResultType != 0, OriginalRequestId, ""), 5), 
+          SetOfSuccessfulEvents = makeset(iff(ResultType == 0, OriginalRequestId, ""), 5) 
+  // Grouping by various attributes
+          by 
+          IPAddress, 
+          UserPrincipalName, 
+          bin(TimeGenerated, 1min), 
+          UserAgent,
+          ConditionalAccessStatus,
+          OperationName,
+          RiskDetail,
+          AuthenticationRequirement,
+          ClientAppUsed
+  // Filtering based on conditions for failed and successful events
+      | where FailedEventsCount >= 5
+          and SuccessfuleventsCount >= 1
+          and FailedEvent > SuccessfulEvent
+  // Extracting the name and UPN suffix from UserPrincipalName
+      | extend
+          Name = tostring(split(UserPrincipalName, '@')[0]),
+          UPNSuffix = tostring(split(UserPrincipalName, '@')[1]));
+  // Materialize a table named "AWS_Bruforce" containing AWS CloudTrail events related to ConsoleLogins within the last 1 day
+  let AWS_Bruforce = materialize (
+      AWSCloudTrail 
+  // Limit the time range to the last 1 days
+      | where TimeGenerated >= ago(1d)
+  // Filter CloudTrail events related to ConsoleLogin
+      | where EventName == "ConsoleLogin" 
+  // Extract ActionType from ResponseElements JSON
+      | extend ActionType = tostring(parse_json(ResponseElements).ConsoleLogin)  
+  // Summarize various counts and sets based on  brute force criteria 
+      | summarize 
+          Successful = countif(ActionType == "Success"), 
+          Failed = countif(ActionType == "Failure"), 
+          totalAwsEventId = dcount(AwsEventId), 
+          FailedEventsCount = dcountif(AwsEventId, ActionType == "Failure"), 
+          SuccessfuleventsCount = dcountif(AwsEventId, ActionType == "Success"), 
+          Failedevents = makeset(iff(ActionType == "Failure", AwsEventId, ""), 5), 
+          SuccessfulEvents = makeset(iff(ActionType == "Success", AwsEventId, ""), 5) 
+  // Grouping by various attributes
+          by 
+          SourceIpAddress, 
+          UserIdentityUserName,
+          bin(TimeGenerated, 1min), 
+          UserAgent 
+  // Filtering based on conditions for failed and successful events
+      | where FailedEventsCount >= 4 and SuccessfuleventsCount >= 1);
+  // Joining the Azure_Bruforce and AWS_Bruforce tables on matching IP addresses and UserAgents
+  Azure_Bruforce
+    |join kind=inner AWS_Bruforce on $left.IPAddress == $right.SourceIpAddress and UserAgent
+entityMappings:
+  - entityType: Account
+    fieldMappings:
+      - identifier: Name
+        columnName: Name
+      - identifier: UPNSuffix
+        columnName: UPNSuffix
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: SourceIpAddress
+kind: Scheduled
+version: 1.0.0

Detections/MultipleDataSources/ExtensiveAWSComputeResurseDeployements.yaml

@@ -0,0 +1,54 @@
+id: 9e457dc4-81f0-4d25-bc37-a5fa4a17946a
+name: Extensive AWS Compute Resurse Deployements
+description: |
+  'This detection focused on Suspicious deployment of AWS EC2 resource (virtual machine) scale sets was detected. This behavior might indicate that the threat actor is deploying computing resources for cryptocurrency mining activities.This detection centers around identifying suspicious instances of AWS EC2 resource deployment, particularly scale sets. Such behavior raises concerns of potential threat actor involvement, potentially indicative of efforts to deploy computing resources for the purpose of cryptocurrency mining activities.
+severity: Medium
+requiredDataConnectors:
+  - connectorId: AWS
+    dataTypes:
+      - AWSCloudTrail
+queryFrequency: 1d
+queryPeriod: 1d
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  -  Impact
+relevantTechniques:
+  - T1496
+query: |
+  // Retrieve AWS CloudTrail events generated within the last day
+  AWSCloudTrail
+  | where TimeGenerated >= ago(1d)
+  // Filter events related to instance creation
+  | where EventName =~ "RunInstances"
+  // Exclude events with error messages
+  | where isempty(ErrorMessage)
+  // Extract the event source type
+  | extend EventSourceSplit = split(EventSource, ".")
+  | extend Type = tostring(EventSourceSplit[0])
+  // Extract instance-related details from the event data
+  | extend instance = tostring(parse_json(RequestParameters).instanceType),platform = tostring(parse_json(ResponseElements).instancesSet.items[0].platform)
+  // Determine the operating system platform
+  | extend OSplatform = iff(isempty(platform), tostring("Linux"), platform),CPU = tostring(parse_json(ResponseElements).instancesSet.items[0].cpuOptions),core = toint(parse_json(ResponseElements).instancesSet.items[0].cpuOptions.coreCount),corThread = toint(parse_json(ResponseElements).instancesSet.items[0].cpuOptions.threadsPerCore),InstanceId = tostring(parse_json(ResponseElements).instancesSet.items[0].instanceId)
+  // Calculate the total compute based on core and thread counts
+  | extend totalCorecompute = core * corThread
+  // Filter out instances with empty core values
+  | where isnotempty(core)
+  // Summarize relevant information for analysis
+  | summarize Start = min(TimeGenerated),
+             end = max(TimeGenerated),
+             totalgpu = sum(totalCorecompute),
+             make_set(UserAgent),
+             make_set(UserIdentityPrincipalid)
+     by SourceIpAddress,
+        UserIdentityType
+  // Filter results based on total GPU compute and time duration
+  | where totalgpu > 800
+  | where datetime_diff('hour', end, Start) < 8
+entityMappings:
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: SourceIpAddress
+kind: Scheduled
+version: 1.0.0

Detections/MultipleDataSources/SucessfullPosswordSprayAttampOnAWSConsolelogin.yaml

@@ -0,0 +1,121 @@
+id: 188db479-d50a-4a9c-a041-644bae347d1f
+name: Successful Password Spray Attempt on AWS Console login
+description: |
+  'This query aims to detect instances of successful AWS console login events followed by multiple failed app logons alerts generated by Microsoft Cloud App Security or password spray alerts generated by Defender Products.
+   Specifically, it focuses on scenarios where the successful login takes place within a 60-minute timeframe of the high-severity alert. 
+   The login is considered relevant if it originates from an IP address associated with potential attackers.'
+severity: Medium
+requiredDataConnectors:
+  - connectorId: AWS
+    dataTypes:
+      - AWSCloudTrail
+  - connectorId: MicrosoftDefenderAdvancedThreatProtection
+    dataTypes:
+      - SecurityAlert
+  - connectorId: AzureActiveDirectoryIdentityProtection
+    dataTypes:
+      - SecurityAlert (IPC)
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
+  - connectorId: MicrosoftThreatProtection
+    dataTypes:
+      - SecurityAlert
+queryFrequency: 1d
+queryPeriod: 1d
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - InitialAccess
+  - CredentialAccess
+relevantTechniques:
+  - T1110
+  - T1078
+query: |
+  SecurityAlert 
+    | where TimeGenerated >= ago(1d)
+  // Filtering alerts based on Microsoft product names and Relevent alert names
+    | where ProductName in ( "Microsoft Cloud App Security","Azure Active Directory Identity Protection")
+    |where AlertName in ("Multiple failed user log on attempts to an app","Password Spray")
+  // Parsing and extending the 'Entities' column as JSON objects
+    | extend Entities = parse_json(Entities) 
+  // Exploring IP entities within the alert entities
+    | mv-apply Entity = Entities on 
+        ( 
+        where Entity.Type == 'ip' 
+        | extend EntityIp = tostring(Entity.Address) 
+        ) 
+  // Exploring account entities within the alert entities
+    | mv-apply Entity = Entities on 
+        ( 
+        where Entity.Type == 'account' 
+        | extend AccountObjectId = tostring(Entity.AadUserId)
+        )
+  // Filtering out alerts with missing IP or account information
+    | where isnotempty(EntityIp) and isnotempty(AccountObjectId)
+  // Summarizing relevant fields for further analysis
+    | summarize 
+        by 
+        AlertName,
+        ProductName,
+        ProviderName,
+        AlertSeverity,
+        EntityIp,
+        Tactics,
+        Techniques,
+        AlertTime= bin(TimeGenerated, 1min),
+        AccountObjectId,
+        AlertTimeGenerated=TimeGenerated
+  // Joining with IdentityInfo to obtain additional account details
+    | join kind=inner (
+        IdentityInfo
+        | where TimeGenerated >= ago(1d)
+        | distinct AccountObjectId, AccountUPN=tolower(AccountUPN)
+        )
+        on AccountObjectId 
+        |extend Name = tostring(split(AccountUPN,'@')[0]), UPNSuffix =tostring(split(AccountUPN,'@')[1])
+  // Joining with AWSCloudTrail data to correlate AWS console logins
+    | join kind=inner (
+        AWSCloudTrail
+        | where TimeGenerated >= ago(1d)
+        | where EventName == "ConsoleLogin"
+        | extend CTUPN= tolower(tostring(tolower(split(UserIdentityArn, "/", 2)[0])))
+        | extend ActionType= tostring(parse_json(ResponseElements).ConsoleLogin)  
+        | where ActionType == "Success"
+        | extend AWSTime= bin(TimeGenerated, 1min)
+        | project
+            EventName,
+            EventSource,
+            EventTypeName,
+            RecipientAccountId,
+            ResponseElements,
+            SessionMfaAuthenticated,
+            SourceIpAddress,
+            TimeGenerated,
+            UserAgent,
+            UserIdentityArn,
+            UserIdentityType,
+            CTUPN,
+            AWSTime,
+            UserIdentityUserName
+        )
+        on $left.EntityIp == $right.SourceIpAddress 
+  // Filtering login event after the Alert generation time
+    | where AlertTimeGenerated >= AWSTime
+  // Calculating the time difference between alert generation and AWS login
+    | extend timediff = datetime_diff('minute', AlertTimeGenerated, TimeGenerated) 
+  // Filtering alerts with a time difference of up to 60 minutes
+    | where timediff <= 60
+entityMappings:
+  - entityType: Account
+    fieldMappings:
+      - identifier: Name
+        columnName: Name
+      - identifier: UPNSuffix
+        columnName: UPNSuffix
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: SourceIpAddress
+kind: Scheduled
+version: 1.0.0

Detections/MultipleDataSources/SuspiciousAWSCLICommandExecution.yaml

@@ -0,0 +1,47 @@
+id: 8c2dc344-9352-4ca1-8863-b1b7a5e09e59
+name: Suspicious AWS CLI Command Execution
+description: |
+  'This detection focuses on identifying potentially suspicious activities involving the execution of AWS Command Line Interface (CLI) commands, particularly focusing on reconnaissance operations.'
+severity: Medium
+requiredDataConnectors:
+  - connectorId: AWS
+    dataTypes:
+      - AWSCloudTrail
+queryFrequency: 1d
+queryPeriod: 1d
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Reconnaissance
+relevantTechniques:
+  - T1596
+query: |
+  // Retrieve AWS CloudTrail events
+  AWSCloudTrail 
+  | where TimeGenerated >= ago(1d)
+  // Filter events with UserAgent starting with "aws-cli"
+  | where UserAgent startswith "aws-cli" 
+  // Extract the command from the UserAgent using string splitting
+  | extend command = tostring(split(UserAgent, "off command/", 1)[0])  
+  // Filter events based on predefined suspicious command list
+  | where command in~ ('iam.list-users', 'iam.list-groups', 'ec2.describe-vpcs', 'ec2.describe-subnets', 'route53.list-hosted-zones', 'kms.list-keys', 'kms.list-aliases', 'ecs.list-clusters', 'ecs.list-services', 'iam.list-roles', 'iam.get-user', 'iam.list-access-keys', 'ec2.describe-security-groups', 'ec2.describe-network-acls', 'ec2.describe-network-interfaces', 'ec2.describe-route-tables', 'ec2.describe-internet-gateways', 'ec2.describe-vpc-peering-connections', 'ec2.describe-network-interfaces', 'ec2.describe-network-interfaces', 'ec2.describe-transit-gateway-vpc-attachment', 'ec2.describe-vpc')
+  // Summarize relevant information for further analysis
+  | summarize 
+      CommadCount = dcount(command), 
+      EventCount = dcount(EventName), 
+      commands = make_list(command), 
+      Events = make_list(EventName) 
+      by 
+      bin(TimeGenerated, 1min), 
+      UserIdentityUserName, 
+      SourceIpAddress, 
+      SessionMfaAuthenticated 
+  // Filter out results with a sufficient count of unique suspicious commands in 1 min time window
+  | where CommadCount >= 8
+entityMappings:
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: SourceIpAddress
+kind: Scheduled
+version: 1.0.0