CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.

Author: Jason Brewer

baselines/train_ec2_excessive_runinstances.yml

@@ -6,9 +6,10 @@ baseline:
       cron_schedule: ''
       earliest_time: -91d@d
       latest_time: -1d@d
-    search: >- 
+    search: >-
       sourcetype=aws:cloudtrail eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
       | bucket span=10m _time 
+      | rename arn AS userName
       | stats count as instances_launched by _time userName 
       | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1
 creation_date: '2019-11-14'
@@ -50,7 +51,7 @@ maintainers:
     email: jbrewer@splunk.com
     name: Jason Brewer
 modification_date: '2019-11-14'
-name: Baseline of Excessive AWS Instances Launched by User
+name: Baseline of Excessive AWS Instances Launched by User - MLTK
 original_authors:
   - company: Splunk
     email: jbrewer@splunk.com

detections/ec2_excessive_runinstances_mltk.yml

@@ -1,7 +1,7 @@
 asset_type: AWS Instance
 baselines:
   - id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
-    name: Baseline of Excessive AWS Instances Launched by User
+    name: Baseline of Excessive AWS Instances Launched by User - MLTK
     type: splunk
 confidence: medium
 creation_date: '2019-11-14'
@@ -36,6 +36,7 @@ detect:
       search: >-
         sourcetype=aws:cloudtrail eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
         | bucket span=10m _time 
+        | rename arn AS userName
         | stats count as instances_launched by _time userName 
         | apply ec2_excessive_runinstances_v1 
         | rename "IsOutlier(instances_launched)" as isOutlier 
@@ -95,7 +96,7 @@ mappings:
     - DE.DP
     - DE.AE
 modification_date: '2019-11-14'
-name: Abnormally High AWS Instances Launched by User
+name: Abnormally High AWS Instances Launched by User - MLTK
 original_authors:
   - company: Splunk
     email: jbrewer@splunk.com

stories/aws_ec2.yml

@@ -20,6 +20,9 @@ detections:
   - detection_id: 22773e84-bac0-4595-b086-20d3f735b4f1
     name: EC2 Instance Started With Previously Unseen User
     type: splunk
+  - detection_id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5
+    name: Abnormally High AWS Instances Launched by User - MLTK
+    type: splunk
 id: 2e8948a5-5239-406b-b56b-6c50f1268af3
 maintainers:
   - company: Splunk

stories/cloud_cryptomining.yml

@@ -13,7 +13,7 @@ detections:
   - detection_id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
     name: Cloud Compute Instance Created With Previously Unseen Instance Type
     type: splunk
-  - detection_id: 8dbcf362-ae43-44ea-9084-77db4bed2c68
+  - detection_id: bc24922d-987c-4645-b288-f8c73ec194c4
     name: Cloud Compute Instance Created With Previously Unseen Image
     type: splunk
   - detection_id: 76988f6a-3935-48f6-a9e5-6fca8b3ed843