From 90504915ad77f8a2284f407fa4c7f109465eb5eb Mon Sep 17 00:00:00 2001 From: Austin Songer Date: Fri, 15 Oct 2021 13:59:33 -0500 Subject: [PATCH] [New Rule] AWS Route53 hosted zone associated with a VPC (#1365) * Create persistence_route_53_hosted_zone_associated_with_a_vpc.toml * Update * Update rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml Co-authored-by: Jonhnathan * Update rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml Co-authored-by: Jonhnathan * Update rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml Co-authored-by: Jonhnathan * Update rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml Co-authored-by: Jonhnathan * Update rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml Co-authored-by: Jonhnathan * Update persistence_route_53_hosted_zone_associated_with_a_vpc.toml * Update persistence_route_53_hosted_zone_associated_with_a_vpc.toml * Update persistence_route_53_hosted_zone_associated_with_a_vpc.toml * Update persistence_route_53_hosted_zone_associated_with_a_vpc.toml Co-authored-by: Jonhnathan --- ..._53_hosted_zone_associated_with_a_vpc.toml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml diff --git a/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml b/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml new file mode 100644 index 000000000..fd4fb5ae5 --- /dev/null +++ b/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml @@ -0,0 +1,51 @@ +[metadata] +creation_date = "2021/07/19" +maturity = "production" +updated_date = "2021/07/19" +integration = "aws" + +[rule] +author = ["Austin Songer"] +description = "Identifies when a Route53 private hosted zone has been associated with VPC." +false_positives = [ + """ + A private hosted zone may be asssociated with a VPC by a system or network administrator. Verify whether the user + identity, user agent, and/or hostname should be making changes in your environment. If known behavior is + causing false positives, it can be exempted from the rule. + """, +] +from = "now-60m" +index = ["filebeat-*", "logs-aws*"] +interval = "10m" +language = "kuery" +license = "Elastic License v2" +name = "AWS Route53 private hosted zone associated with a VPC" +note = """## Config + +The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.""" +references = ["https://docs.aws.amazon.com/Route53/latest/APIReference/API_AssociateVPCWithHostedZone.html"] +risk_score = 21 +rule_id = "e3c27562-709a-42bd-82f2-3ed926cced19" +severity = "low" +tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Asset Visibility"] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com and event.action:AssociateVPCWithHostedZone and +event.outcome:success +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +reference = "https://attack.mitre.org/techniques/T1098/" +name = "Account Manipulation" + +[rule.threat.tactic] +id = "TA0003" +reference = "https://attack.mitre.org/tactics/TA0003/" +name = "Persistence" +