Crowdstrike IP Allowlist Changed

Description

Updates were made to Falcon console's allowlist. This could indicate a bad actor permitting access from another machine, or could be attackers preventing legitimate actors from accessing the console.

Query · python

from panther_crowdstrike_event_streams_helpers import audit_keys_dict, cs_alert_context, str_to_list


def rule(event):
    # Only alert if an allow list is created or edited
    op_name = event.deep_get("event", "OperationName")
    if op_name not in ("CreateAllowlistGroup", "UpdateAllowlistGroup"):
        return False

    return True


def title(event):
    actor = event.deep_get("event", "UserId")
    action = {
        "CreateAllowlistGroup": "created a new",
        "UpdateAllowlistGroup": "made changes to",
    }.get(event.deep_get("event", "OperationName"))
    group = audit_keys_dict(event).get("group_name", "UNKNWOWN GROUP")
    return f"{actor} {action} Crowdstrike IP allowlist group: {group}"


def alert_context(event):
    context = cs_alert_context(event)

    # Be nice and concert the "lists" into actual lists so customers can easily process the alert
    #   context
    for key in ("cidrs", "old_cidrs", "contexts", "old_contexts"):
        if context.get(key):
            try:
                context[key] = str_to_list(context[key])
            except ValueError:
                pass  # Just ignore if we can't unmarshal it

    # Find out what entries were removed, and which were added
    op_name = event.deep_get("event", "OperationName")
    audit_keys = audit_keys_dict(event)
    added_cidrs = []
    removed_cidrs = []
    added_contexts = []
    removed_contexts = []

    def getlist(key: str):
        return str_to_list(audit_keys.get(key))

    match op_name:
        case "UpdateAllowlistGroup":
            new_cidrs = getlist("cidrs")
            old_cidrs = getlist("old_cidrs")
            new_ctx = getlist("contexts")
            old_ctx = getlist("old_contexts")
            added_cidrs = get_unique_entries(new_cidrs, old_cidrs)
            removed_cidrs = get_unique_entries(old_cidrs, new_cidrs)
            added_contexts = get_unique_entries(new_ctx, old_ctx)
            removed_contexts = get_unique_entries(old_ctx, new_ctx)
        case "CreateAllowlistGroup":
            added_cidrs = str_to_list(audit_keys.get("cidrs", []))
            added_contexts = str_to_list(audit_keys.get("contexts", []))

    context.update(
        {
            "changes": {
                "cidr_added": added_cidrs,
                "cidr_removed": removed_cidrs,
                "context_added": added_contexts,
                "context_removed": removed_contexts,
            }
        }
    )

    return context


def get_unique_entries(list1: list, list2: list) -> list:
    """Returns items in l1 that are not in l2."""
    return list(set(list1) - set(list2))

Analyst notes

Validate this action was authorized.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Stable
Query type: python
Created: 2024-08-13
Modified: 2024-08-21
Authored by: panther-labs
Source ID
Upstream: rules/crowdstrike_rules/event_stream_rules/crowdstrike_ip_allowlist_changed.yml
Type: rule
Version: 1
Data sources: Crowdstrike.EventStreams

ATT&CK

TA0003TA0005TA0006 T1556.009

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.