ASL AWS ECR Container Upload Unknown User

Name:ASL AWS ECR Container Upload Unknown User
id:886a8f46-d7e2-4439-b9ba-aec238e31732
version:13
date:None
author:Patrick Bareiss, Splunk
status:production
type:Anomaly
Description:The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
Data_source:

• -ASL AWS CloudTrail

search:`amazon_security_lake`
api.operation=PutImage
NOT `aws_ecr_users_asl`

| fillnull

| stats count min(_time) as firstTime
max(_time) as lastTime

by actor.user.uid api.operation api.service.name
http_request.user_agent
src_endpoint.ip actor.user.account.uid
cloud.provider cloud.region

| rename actor.user.account.uid as vendor_account
actor.user.uid as user
api.operation as action
api.service.name as dest
cloud.provider as vendor_product
cloud.region as vendor_region
http_request.user_agent as user_agent
src_endpoint.ip as src

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `asl_aws_ecr_container_upload_unknown_user_filter`

how_to_implement:The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives:No false positives have been identified at this time.
References:
  -https://attack.mitre.org/techniques/T1204/003/
drilldown_searches:
 name:'View the detection results for - "$user$"'
 search:'%original_detection_search% | search user = "$user$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$user$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['Dev Sec Ops']

asset_type:AWS Account

mitre_attack_id:['T1204.003']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:cloud

security_domain:network

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail.json
  sourcetype: aws:asl
  source: aws_asl
 test_type:'unit'
manual_test:None