Splunk unknown stable spl

AWS S3 Exfiltration Behavior Identified

The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. It leverages risk events from AWS sources, focusing on instances where two or more unique analytics and distinct MITRE ATT&CK IDs are triggered for a specific risk object. This activity is significant as it may indicate an ongoing data exfiltration attempt, which is critical for security teams to monitor. If confirmed malicious, this could lead to unauthorized access and theft of sensitive information, compromising the organization's data integrity and confidentiality.

View Source

Detection Logic

| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message 
FROM datamodel=Risk.All_Risk
  
WHERE All_Risk.annotations.mitre_attack.mitre_tactic = "collection"
    
OR
    All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration" source = *AWS*
  BY All_Risk.risk_object
| `drop_dm_object_name(All_Risk)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where source_count >= 2 and mitre_tactic_id_count>=2
| `aws_s3_exfiltration_behavior_identified_filter`

False Positives

  • ⚠ False positives may be present based on automated tooling or system administrators. Filter as needed.

Field Validations

Loading…

Comments (0)

Loading comments...