security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
11,444 Commits 1 Branch 57 Tags
fda9c753e2dcbefeebfdb1505428feeeb2d5fef1
Commit Graph

72 Commits

Author SHA1 Message Date
Darin Smith d29eb1e48c Change to all selection elements rather than a filter and a selection 2022-06-08 09:13:48 -07:00
Darin Smith 04bcbcdb44 Minor change, filter param should not be a list 2022-06-08 06:58:19 -07:00
Darin Smith 61df0b9218 Update with suggested changes 2022-06-08 06:47:30 -07:00
Darin Smith 09e31d2045 update with command field 2022-06-07 10:45:05 -07:00
Darin Smith 8a59eb594e Add rule for ECS backdoors 2022-06-07 10:36:31 -07:00
Rachel Rice db58345bc6 Update selection_source for AWS ec2 startup script rule 
The JSON payload for `ModifyInstanceAttribute` event currently looks like:
```
"requestParameters": {
  "attribute": "userData",
  ...
},
```

Updating the selection_source from `requestParameters.userData: "*"` to `requestParameters.attribute: "userData"` accordingly.

Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2022-06-07 13:20:08 +01:00
David ANDRE 74b9f97b9c Renamed suspicious in filenames to susp 2022-05-19 09:37:04 +02:00
phantinuss b23eee6ebf fix: unknown --> Unknown 2022-03-16 13:43:54 +01:00
frack113 4631d0c482 remove invalid tag 2022-01-19 18:23:30 +01:00
frack113 73f258e2d1 Change double quote to quote 2022-01-06 14:02:35 +01:00
frack113 c6caab9e1e Fix optional section name 2021-11-27 11:27:40 +01:00
frack113 b293372913 Add product aws 2021-11-14 09:56:59 +01:00
Stefan Grimminck 47502e6701 add MITRE technique mapping 2021-10-20 14:29:57 +02:00
Austin Songer 7ad0887704 Update passed_role_to_glue_development_endpoint.yml 2021-10-14 12:10:48 -05:00
Austin Songer 70b55f2c2d Update aws_lambda_function_created_or_invoked.yml 2021-10-14 12:10:29 -05:00
Austin Songer 40879252a8 Update aws_lambda_function_created_or_invoked.yml 2021-10-13 16:25:28 -05:00
Austin Songer f7dba3fbff Update passed_role_to_glue_development_endpoint.yml 2021-10-13 12:34:16 -05:00
Austin Songer 503a4bc72b Update and rename aws_pass_role_to_lambda_function.yml to aws_lambda_function_created_or_invoked.yml 2021-10-13 12:27:24 -05:00
Austin Songer e08f6333b8 Update aws_pass_role_to_lambda_function.yml 2021-10-13 06:59:13 -05:00
Austin Songer 010b0e2868 Update passed_role_to_glue_development_endpoint.yml 2021-10-13 06:58:57 -05:00
frack113 d081d20a13 Merge pull request #2119 from austinsonger/privilege_escalation_pass_role_to_lambda_function.yml 
passed_role_to_glue_development_endpoint.yml and passed_role_to_lambda_function.yml
 2021-10-10 11:01:36 +02:00
Austin Songer 1987897a76 Update aws_pass_role_to_lambda_function.yml 2021-10-09 15:26:38 -05:00
Austin Songer de52890a62 Update passed_role_to_glue_development_endpoint.yml 2021-10-09 15:24:49 -05:00
Rachel Rice d9e5da6c86 Use startswith for eventName selection 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-10-05 17:52:52 +01:00
Rachel Rice 4ae3ece314 Update AWS SAML and Lambda rules 
Use correct case for `AssumeRoleWithSAML` event name.
`UpdateFunctionConfiguration`, `UpdateFunctionConfiguration20150331` and `UpdateFunctionConfiguration20150331v2` are all valid event names for updating Lambda function configuration, added selection condition for any of these.
 2021-10-05 14:08:40 +01:00
frack113 ad9362e043 Update passed_role_to_glue_development_endpoint.yml 2021-10-05 07:41:41 +02:00
frack113 3b01425936 Update aws_pass_role_to_lambda_function.yml 2021-10-05 07:40:42 +02:00
Austin Songer d694d6faa8 Create passed_role_to_glue_development_endpoint.yml 2021-10-03 23:03:39 -05:00
Austin Songer 60eccf711d Rename pass_role_to_lambda_function.yml to aws_pass_role_to_lambda_function.yml 2021-10-03 22:54:19 -05:00
Austin Songer 92b1ce4cf4 Create pass_role_to_lambda_function.yml 2021-10-03 22:54:01 -05:00
Austin Songer 0d07a78a2d Update aws_attached_malicious_lambda_layer.yml 2021-09-27 23:41:19 -05:00
Austin Songer 8203a2d5f2 Update aws_attached_malicious_lambda_layer.yml 2021-09-23 08:40:26 -05:00
Austin Songer fdc45505e0 Create aws_attached_malicious_lambda_layer.yml 2021-09-23 08:38:02 -05:00
Austin Songer b9123422b8 Delete aws_attached_malicious_lambda_layer.yml 2021-09-23 08:37:34 -05:00
Austin Songer 9e9fd4c23d Create aws_attached_malicious_lambda_layer.yml 2021-09-23 08:37:20 -05:00
frack113 934e391159 fix filename 2021-09-23 14:51:59 +02:00
frack113 0288f5b626 fix condition operator case 2021-09-10 13:51:52 +02:00
Rachel Rice be5351947c Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Rachel Rice eef6e71e2e Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
frack113 bd1b4c0d70 Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
Rachel Rice 78d3fa4795 Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice 7ccb773b20 Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113 52595de85e Merge pull request #1889 from rachelrice/update_aws_rules 
Update AWS CloudTrail rules
 2021-08-23 11:14:31 +02:00
frack113 b9a355e3f4 cleanup falsepositives 2021-08-20 17:18:32 +02:00
Florian Roth b92346ba5f Merge pull request #1882 from austinsonger/win_susp_bitstransfer.yml 
win_susp_bitstransfer.yml
 2021-08-20 16:53:52 +02:00
Rachel Rice f037f5b0a9 Add filter3 back for vm export failure, without consolelogin 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-08-20 15:42:49 +01:00
Rachel Rice f09b3ea4b1 Update AWS CloudTrail rules 
aws_ec2_disable_encryption.yml
Remove `status: success` from selection criteria, not required

aws_ec2_vm_export_failure.yml
Remove filter3:
```
eventName: 'ConsoleLogin'
responseElements|contains: 'Failure'
```
Incompatible with selection criteria `eventName: 'CreateInstanceExportTask'`

aws_ec2_download_userdata.yml, aws_iam_backdoor_users_keys.yml, aws_rds_change_master_password.yml, aws_rds_public_db_restore.yml
Update reference

aws_sts_assumedrole_misuse.yml
Rename to aws_sts_assumerole_misuse.yml
Update references to "AssumedRole" to "AssumeRole"
Update selection criteria of `userIdentity.sessionContext: Role` to `userIdentity.sessionContext.sessionIssuer.type: Role`
 2021-08-20 13:43:00 +01:00
Austin Songer 810aae5ddd Update aws_eks_cluster_created_or_deleted.yml 2021-08-19 21:58:36 -05:00
Austin Songer 842ade16be Forgot to add my username to some of the rules. 2021-08-20 02:09:31 +00:00
Austin Songer 9a83836070 Update aws_eks_cluster_created_or_deleted.yml 2021-08-19 21:00:36 -05:00