topic Re: How to Detect 4 Commands run Within a 1 Second Time Window? in Splunk Search

How to detect four commands run within a 1 second time window?

garryplewson — Mon, 30 May 2022 23:36:17 GMT

Hello,

I am trying to create a detection of the AWS exploitation tool Pacu.py. It is to detect the use of the enumeration tool within Pacu.py, which executes the following AWS commands in less than a second:

ListUserPolicies
GetCallerIdentity
ListGroupsForUser
ListAttachedUserPolicies

Timeframe:

First Event: 2022-05-19 10:02:25
Last Event: 2022-05-19 10:02:26

Each command generates a separate event so I was wondering if it is possible to create a search which detects these command executed from the same account within a 1 second timeframe? I am unsure how to specify a time window so if you could help, that would be greatly appreciated.

Query

index="aws-cloudtrail" "GetCallerIdentity" OR "ListUserPolicies" OR "ListGroupsForUser" OR "ListAttachedUserPolicies" | table _time, principalId, userName, aws_account_id, sourceIPAddress, user_agent, command

Many Thanks

Re: How to Detect 4 Commands run Within a 1 Second Time Window?

yuanliu — Sun, 29 May 2022 03:36:15 GMT

The most straightforward method may be transaction. Since you are looking at a specific tool, I assume that there is an order of execution, e.g.,

ListUserPolicies
GetCallerIdentity
ListGroupsForUser
ListAttachedUserPolicies

Given these assumptions, you can do something like

index="aws-cloudtrail" "GetCallerIdentity" OR "ListUserPolicies" OR "ListGroupsForUser" OR "ListAttachedUserPolicies" ```| table _time, principalId, userName, aws_account_id, sourceIPAddress, user_agent, command``` | transaction aws_account_id startswith=command=="ListUserPolicies" endswith=command=="ListAttachedUserPolicies" maxspan=1s mvlist=command | where mvjoin(command, ",") == "ListUserPolicies,GetCallerIdentity,ListGroupsForUser,ListAttachedUserPolicies"

maxspan limits elapsed time from the first command to the last command. The where filter is to constrain the order of execution.