name: Detect new user AWS Console Login
id: ada0f478-84a8-4641-a3f3-d82362dffd75
version: 2
date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
  The alert is fired if the user has logged into the console for the first time within
  the last hour. Deprecated now this search is updated to use the Authentication datamodel.
search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | stats
  earliest(_time) as firstTime latest(_time) as lastTime by user | inputlookup append=t
  previously_seen_users_console_logins_cloudtrail  | stats min(firstTime) as firstTime
  max(lastTime) as lastTime by user | eval userStatus=if(firstTime >= relative_time(now(),
  "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
  where userStatus ="First Time Logging into AWS Console"  | `detect_new_user_aws_console_login_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. Run the "Previously seen users in CloudTrail" support search only once to
  create a baseline of previously seen IAM users within the last 30 days. Run "Update
  previously seen users in CloudTrail" hourly (or more frequently depending on how
  often you run the detection searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this
  activity will be detected. Check how old the account is and verify that the user
  activity is legitimate.
references: []
tags:
  analytic_story:
  - Suspicious AWS Login Activities
  asset_type: AWS Instance
  cis20:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1078.004
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - userIdentity.arn
  security_domain: network
