Skip to content

Commit 5b6f8ea

Browse files
pyth0n1cpyth0n1c
committed
Fix more errors with missing lookups, baselines, and detections
1 parent ef2ac2a commit 5b6f8ea

9 files changed

+57
-21
lines changed

‎baselines/deprecated/previously_seen_ec2_amis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
name: Previously Seen EC2 AMIs
22
id: bb1bd99d-1e93-45f1-9571-cfed42d372b9
3-
version: 1
4-
date: '2018-03-12'
3+
version: 2
4+
date: '2025-01-16'
55
author: David Dorsey, Splunk
66
type: Baseline
77
description: This search builds a table of previously seen AMIs used to launch EC2
88
instances
99
search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId
1010
as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID
11-
| outputlookup previously_seen_ec2_amis | stats count'
11+
| outputlookup previously_seen_ec2_amis_baseline | stats count'
1212
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
1313
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
1414
inputs.

‎baselines/deprecated/previously_seen_ec2_instance_types.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
name: Previously Seen EC2 Instance Types
22
id: b8f029f2-65a6-4d76-be98-dad1c9d59c45
3-
version: 1
4-
date: '2018-03-08'
3+
version: 2
4+
date: '2025-01-16'
55
author: David Dorsey, Splunk
66
type: Baseline
77
description: This search builds a table of previously seen EC2 instance types
88
search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType
99
as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time)
10-
as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types
10+
as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types_lookup
1111
| stats count'
1212
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
1313
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail

‎baselines/deprecated/previously_seen_ec2_launches_by_user.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
name: Previously Seen EC2 Launches By User
22
id: 6c767ac0-0906-4355-9a83-927f5ee7bdad
3-
version: 1
4-
date: '2018-03-15'
3+
version: 2
4+
date: '2025-01-16'
55
author: David Dorsey, Splunk
66
type: Baseline
77
description: This search builds a table of previously seen ARNs that have launched
88
a EC2 instance.
99
search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn
1010
as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup
11-
previously_seen_ec2_launches_by_user | stats count'
11+
previously_seen_ec2_launches_by_user_lookup | stats count'
1212
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
1313
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
1414
inputs.

‎detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: EC2 Instance Started With Previously Unseen AMI
22
id: 347ec301-601b-48b9-81aa-9ddf9c829dd3
3-
version: 4
4-
date: '2024-11-14'
3+
version: 5
4+
date: '2025-01-16'
55
author: David Dorsey, Splunk
66
status: deprecated
77
type: Anomaly
@@ -12,8 +12,8 @@ data_source: []
1212
search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
1313
errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime
1414
by requestParameters.instancesSet.items{}.imageId | rename requestParameters.instancesSet.items{}.imageId
15-
as amiID | inputlookup append=t previously_seen_ec2_amis | stats min(firstTime)
16-
as firstTime max(lastTime) as lastTime by amiID | outputlookup previously_seen_ec2_amis
15+
as amiID | inputlookup append=t previously_seen_ec2_amis_lookup | stats min(firstTime)
16+
as firstTime max(lastTime) as lastTime by amiID | outputlookup previously_seen_ec2_amis_lookup
1717
| eval newAMI=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
1818
| where newAMI=1 | rename amiID as requestParameters.instancesSet.items{}.imageId
1919
| table requestParameters.instancesSet.items{}.imageId] | rename requestParameters.instanceType

‎detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: EC2 Instance Started With Previously Unseen Instance Type
22
id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad
3-
version: 5
4-
date: '2024-11-14'
3+
version: 6
4+
date: '2025-01-16'
55
author: David Dorsey, Splunk
66
status: deprecated
77
type: Anomaly
@@ -12,9 +12,9 @@ data_source: []
1212
search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
1313
errorCode=success | fillnull value="m1.small" requestParameters.instanceType | stats
1414
earliest(_time) as earliest latest(_time) as latest by requestParameters.instanceType
15-
| rename requestParameters.instanceType as instanceType | inputlookup append=t previously_seen_ec2_instance_types
15+
| rename requestParameters.instanceType as instanceType | inputlookup append=t previously_seen_ec2_instance_types_lookup
1616
| stats min(earliest) as earliest max(latest) as latest by instanceType | outputlookup
17-
previously_seen_ec2_instance_types | eval newType=if(earliest >= relative_time(now(),
17+
previously_seen_ec2_instance_types_lookup | eval newType=if(earliest >= relative_time(now(),
1818
"-70m@m"), 1, 0) | `security_content_ctime(earliest)` | `security_content_ctime(latest)`
1919
| where newType=1 | rename instanceType as requestParameters.instanceType | table
2020
requestParameters.instanceType] | spath output=user userIdentity.arn | rename requestParameters.instanceType

‎detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: EC2 Instance Started With Previously Unseen User
22
id: 22773e84-bac0-4595-b086-20d3f735b4f1
3-
version: 5
4-
date: '2024-11-14'
3+
version: 6
4+
date: '2025-01-16'
55
author: David Dorsey, Splunk
66
status: deprecated
77
type: Anomaly
@@ -11,9 +11,9 @@ description: This search looks for EC2 instances being created by users who have
1111
data_source: []
1212
search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
1313
errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime
14-
by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user
14+
by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user_lookup
1515
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup
16-
previously_seen_ec2_launches_by_user | eval newUser=if(firstTime >= relative_time(now(),
16+
previously_seen_ec2_launches_by_user_lookup | eval newUser=if(firstTime >= relative_time(now(),
1717
"-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
1818
| rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType
1919
as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn

‎lookups/previously_seen_ec2_amis_lookup.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: previously_seen_ec2_amis_lookup
2+
date: 2025-01-16
3+
version: 2
4+
id: a0d24031-61b5-44b8-89f9-17f844415b8a
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
7+
description: A place holder for a list of used Previously Seen EC2 AMIs
8+
fields:
9+
- _key
10+
- firstTime
11+
- lastTime
12+
- amiID

‎lookups/previously_seen_ec2_instance_types_lookup.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: previously_seen_ec2_instance_types_lookup
2+
date: 2025-01-16
3+
version: 2
4+
id: 37507f63-27c5-488e-ba5b-cf38274997ff
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
7+
description: A place holder for a list of used previously seen EC2 instance types.
8+
fields:
9+
- _key
10+
- earliest
11+
- latest
12+
- instanceType

‎lookups/previously_seen_ec2_launches_by_user_lookup.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: previously_seen_ec2_launches_by_user_lookup
2+
date: 2025-01-16
3+
version: 2
4+
id: a4a6d268-3c88-4996-b634-2edc33344a0a
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
7+
description: A place holder for a list of previouslyt seen EC2 launches by user
8+
fields:
9+
- _key
10+
- firstTime
11+
- lastTime
12+
- arn

0 commit comments

Comments
 (0)