Techniques
Sample rules
Cloud Compute Instance Created By Previously Unseen User
- source: splunk
- technicques:
- T1078.004
- T1078
Description
This search looks for cloud compute instances created by users who have not created them before.
Detection logic
| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region
| `drop_dm_object_name("All_Changes")`
| lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
| eventstats max(enough_data) as enough_data
| where enough_data=1
| eval firstTimeSeenUser=min(firstTimeSeen)
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
| table firstTime, user, dest, count vendor_region
| `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_by_previously_unseen_user_filter`