name: aws detect permanent key creation
id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
version: 1
date: '2020-07-27'
author: Rod Soto, Splunk
type: batch
datamodel: []
description: This search provides detection of accounts creating permanent keys. Permanent
  keys are not created by default and they are only needed for programmatic calls.
  Creation of Permanent key is an important event to monitor.
search: '`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey
  "userIdentity.type"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent
  action status responseElements.accessKey.createDate responseElements.accessKey.status
  responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with cloudwatch logs
known_false_positives: Not all permanent key creations are malicious. If there is
  a policy of rotating keys this search can be adjusted to provide better context.
references: []
tags:
  analytic_story:
  - AWS Cross Account Activity
  asset_type: AWS Account
  kill_chain_phases:
  - Lateral Movement
  mitre_attack_id:
  - T1078
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - userIdentity.type
  - sourceIPAddress
  - userName userIdentity.type
  - userAgent
  - action
  - status
  - responseElements.accessKey.createDate
  - esponseElements.accessKey.status
  - responseElements.accessKey.accessKeyId
  security_domain: threat
