ASL AWS ECR Container Upload Unknown User

name: ASL AWS ECR Container Upload Unknown User
id: 886a8f46-d7e2-4439-b9ba-aec238e31732
version: 13
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
    It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake`
    api.operation=PutImage
    NOT `aws_ecr_users_asl`

    | fillnull

    | stats count min(_time) as firstTime
                  max(_time) as lastTime

      by actor.user.uid api.operation api.service.name
         http_request.user_agent
         src_endpoint.ip actor.user.account.uid
         cloud.provider cloud.region

    | rename actor.user.account.uid as vendor_account
             actor.user.uid as user
             api.operation as action
             api.service.name as dest
             cloud.provider as vendor_product
             cloud.region as vendor_region
             http_request.user_agent as user_agent
             src_endpoint.ip as src

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `asl_aws_ecr_container_upload_unknown_user_filter`
how_to_implement: |-
    The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: |-
    No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1204/003/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Container uploaded from unknown user [$user$].
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail.json
          sourcetype: aws:asl
          source: aws_asl
      test_type: unit