Skip to content

[Security Content] Add Investigation Guides - Cloud - 2#2124

Merged
w0rk3r merged 12 commits into
mainfrom
cloud_investigation_guides_2
Jul 22, 2022
Merged

[Security Content] Add Investigation Guides - Cloud - 2#2124
w0rk3r merged 12 commits into
mainfrom
cloud_investigation_guides_2

Conversation

@w0rk3r
Copy link
Copy Markdown
Contributor

@w0rk3r w0rk3r commented Jul 19, 2022

Summary

Add Investigation Guides to the following cloud rules:

  • AWS IAM Brute Force of Assume Role Policy
  • AWS IAM User Addition to Group
  • AWS IAM Deactivation of MFA Device
  • AWS IAM Assume Role Policy Update
  • Azure Service Principal Addition
  • Azure Active Directory High Risk Sign-in
  • Azure Active Directory High Risk User Sign-in Heuristic
  • Azure Active Directory PowerShell Sign-in
  • Possible Consent Grant Attack via Azure-Registered Application
  • Azure Privilege Identity Management Role Modified

@w0rk3r w0rk3r self-assigned this Jul 19, 2022
terrancedejesus
terrancedejesus approved these changes Jul 19, 2022
View reviewed changes
Copy link
Copy Markdown
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wow, great work!

imays11
imays11 approved these changes Jul 19, 2022
View reviewed changes
Copy link
Copy Markdown
Contributor

@imays11 imays11 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

benironside
benironside reviewed Jul 19, 2022
View reviewed changes
Copy link
Copy Markdown
Contributor

@benironside benironside left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, it looks great! I left a lot of suggestions, I hope they are helpful. Please feel free to let me know if you have any questions.

Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread ...integrations/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml
Comment thread ...integrations/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml Outdated
Comment thread ...integrations/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml
Comment thread rules/integrations/azure/persistence_azure_privileged_identity_management_role_modified.toml Outdated
Comment thread rules/integrations/azure/persistence_azure_privileged_identity_management_role_modified.toml Outdated
w0rk3r added a commit that referenced this pull request Jul 20, 2022
@w0rk3r
Applies suggestions from the #2124 PR
94ebb5a
w0rk3r added a commit that referenced this pull request Jul 20, 2022
@w0rk3r @terrancedejesus @Mikaayenson
[Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104)
d854b94 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the #2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
protectionsmachine pushed a commit that referenced this pull request Jul 20, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104)
edef90b 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the #2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit d854b94)
protectionsmachine pushed a commit that referenced this pull request Jul 20, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104)
06849ac 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the #2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit d854b94)
protectionsmachine pushed a commit that referenced this pull request Jul 20, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104)
2da6f3c 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the #2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit d854b94)
protectionsmachine pushed a commit that referenced this pull request Jul 20, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104)
77cb5cc 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the #2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit d854b94)
protectionsmachine pushed a commit that referenced this pull request Jul 20, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104)
457b5de 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the #2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit d854b94)
@botelastic botelastic Bot added the ML machine learning related rule label Jul 20, 2022
@w0rk3r w0rk3r requested a review from benironside July 20, 2022 16:18
@w0rk3r
Copy link
Copy Markdown
Contributor Author

w0rk3r commented Jul 20, 2022

Hey @benironside thanks for the review. @joepeeples @nastasha-solomon @benironside can I have a final round to be ready for merge?

nastasha-solomon
nastasha-solomon reviewed Jul 21, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a handful of comments for your consideration and one question. Thanks for writing all of this @w0rk3r !

Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/azure/defense_evasion_azure_service_principal_addition.toml Outdated
Comment thread rules/integrations/azure/initial_access_azure_active_directory_high_risk_signin.toml Outdated
Comment thread ...ations/azure/initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/azure/initial_access_azure_active_directory_powershell_signin.toml Outdated
Comment thread ...integrations/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml Outdated
Comment thread ...integrations/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml Outdated
Comment thread ...integrations/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml Outdated
nastasha-solomon
nastasha-solomon approved these changes Jul 22, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a handful of super minor edits for your consideration. Thanks again for all your help on this @w0rk3r !

Comment thread rules/integrations/aws/privilege_escalation_updateassumerolepolicy.toml
Comment thread rules/integrations/azure/initial_access_azure_active_directory_high_risk_signin.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
Comment thread rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml Outdated
w0rk3r and others added 2 commits July 22, 2022 14:21
@w0rk3r @nastasha-solomon
Apply suggestions from code review
df918e0 
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
@w0rk3r
Merge branch 'main' into cloud_investigation_guides_2
41068b5
@w0rk3r w0rk3r merged commit 7ddae4b into main Jul 22, 2022
@w0rk3r w0rk3r deleted the cloud_investigation_guides_2 branch July 22, 2022 17:32
protectionsmachine pushed a commit that referenced this pull request Jul 22, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides - Cloud - 2 (#2124)
cf4b6e6 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

(cherry picked from commit 7ddae4b)
protectionsmachine pushed a commit that referenced this pull request Jul 22, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides - Cloud - 2 (#2124)
8fcae85 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

(cherry picked from commit 7ddae4b)
protectionsmachine pushed a commit that referenced this pull request Jul 22, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides - Cloud - 2 (#2124)
c589fce 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

(cherry picked from commit 7ddae4b)
protectionsmachine pushed a commit that referenced this pull request Jul 22, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides - Cloud - 2 (#2124)
600ead7 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

(cherry picked from commit 7ddae4b)
protectionsmachine pushed a commit that referenced this pull request Jul 22, 2022
@w0rk3r @github-actions
[Security Content] Add Investigation Guides - Cloud - 2 (#2124)
eea9b53 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

(cherry picked from commit 7ddae4b)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imays11 imays11 imays11 approved these changes

@nastasha-solomon nastasha-solomon nastasha-solomon approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@joepeeples joepeeples Awaiting requested review from joepeeples

@benironside benironside Awaiting requested review from benironside

Assignees

@w0rk3r w0rk3r

Labels

backport: auto Domain: Cloud Workloads Integration: AWS AWS related rules Integration: Azure azure related rules ML machine learning related rule Security Content

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r @imays11 @nastasha-solomon @benironside @terrancedejesus