From 34655374c18b7a3da779a02ef8ace39b72aaeb23 Mon Sep 17 00:00:00 2001 From: Pete Hampton Date: Thu, 28 Apr 2022 19:43:26 +0100 Subject: [PATCH] [New Rule] AWS Redshift Cluster Creation (#1921) * Add rule for Redshift data warehouse creation. * Add fp block. * Add AWS integration metadata. * Add timestamp override. * Add note. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan * Update description for redshift instance creation. Co-authored-by: Jonhnathan --- ...ersistence_redshift_instance_creation.toml | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 rules/integrations/aws/persistence_redshift_instance_creation.toml diff --git a/rules/integrations/aws/persistence_redshift_instance_creation.toml b/rules/integrations/aws/persistence_redshift_instance_creation.toml new file mode 100644 index 00000000000..590767605aa --- /dev/null +++ b/rules/integrations/aws/persistence_redshift_instance_creation.toml @@ -0,0 +1,50 @@ +[metadata] +creation_date = "2022/04/12" +maturity = "production" +updated_date = "2022/04/12" +integration = "aws" + +[rule] +author = ["Elastic"] +description = """ +Identifies the creation of an Amazon Redshift cluster. Unexpected creation of this cluster by a non-administrative user +may indicate a permission or role issue with current users. If unexpected, the resource may not properly be configured +and could introduce security vulnerabilities. +""" +false_positives = [ + """ + Valid clusters may be created by a system or network administrator. Verify whether the user identity, user agent, + and/or hostname should be making changes in your environment. Cluster creations by unfamiliar users or hosts + should be investigated. If known behavior is causing false positives, it can be exempted from the rule. + """, +] +from = "now-60m" +index = ["filebeat-*", "logs-aws*"] +interval = "10m" +language = "kuery" +license = "Elastic License v2" +name = "AWS Redshift Cluster Creation" +note = """## Config + +The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.""" +references = ["https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateCluster.html"] +risk_score = 21 +rule_id = "015cca13-8832-49ac-a01b-a396114809f6" +severity = "low" +timestamp_override = "event.ingested" +tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Asset Visibility"] +type = "query" + +query = ''' +event.dataset:aws.cloudtrail and event.provider:redshift.amazonaws.com and event.action:CreateCluster and event.outcome:success +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" +