From 9508002bb3813ac0efea3ea8769b873eb4c57a62 Mon Sep 17 00:00:00 2001 From: Austin Songer Date: Tue, 5 Oct 2021 12:00:29 -0500 Subject: [PATCH] [New Rule] AWS ElastiCache Security Group Created (#1363) * Create persistence_elasticache_security_group_creation.toml * Update * Update rules/integrations/aws/persistence_elasticache_security_group_creation.toml Co-authored-by: Jonhnathan * Rename persistence_elasticache_security_group_creation.toml to defense_evasion_elasticache_security_group_creation.toml * Update defense_evasion_elasticache_security_group_creation.toml * Update defense_evasion_elasticache_security_group_creation.toml * Re-add rule.threat * Update rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml Co-authored-by: Jonhnathan * remove extra space from query Co-authored-by: Jonhnathan Co-authored-by: Justin Ibarra --- ...n_elasticache_security_group_creation.toml | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml diff --git a/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml b/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml new file mode 100644 index 000000000..5a5c74e87 --- /dev/null +++ b/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml @@ -0,0 +1,54 @@ +[metadata] +creation_date = "2021/07/19" +maturity = "production" +updated_date = "2021/10/01" +integration = "aws" + +[rule] +author = ["Austin Songer"] +description = "Identifies when an ElastiCache security group has been created." +false_positives = [ + """ + A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user + agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users + or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. + """, +] +from = "now-60m" +index = ["filebeat-*", "logs-aws*"] +interval = "10m" +language = "kuery" +license = "Elastic License v2" +name = "AWS ElastiCache Security Group Created" +note = """## Config + +The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.""" +references = ["https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSecurityGroup.html"] +risk_score = 21 +rule_id = "7b3da11a-60a2-412e-8aa7-011e1eb9ed47" +severity = "low" +tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:"Create Cache Security Group" and +event.outcome:success +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1562" +name = "Impair Defenses" +reference = "https://attack.mitre.org/techniques/T1562/" + + [[rule.threat.technique.subtechnique]] + id = "T1562.007" + name = "Disable or Modify Cloud Firewall" + reference = "https://attack.mitre.org/techniques/T1562/007/" + +[rule.threat.tactic] +name = "Defense Evasion" +id = "TA0005" +reference = "https://attack.mitre.org/tactics/TA0005/"