name: AWS Credential Access GetPasswordData
id: 4d347c4a-306e-41db-8d10-b46baf71b3e2
version: 1
date: '2022-08-10'
author: Bhavin Patel, Splunk
type: Anomaly
datamodel: []
description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance.
search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com |  bin _time span=5m |  stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time 
|  where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment. 
known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.
references:
- https://attack.mitre.org/techniques/T1552/
- https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
tags:
  analytic_story:
  - AWS Identity and Access Management Account Takeover
  asset_type: AWS Account
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  confidence: 70
  context:
  - Source:Cloud Data
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json
  impact: 70
  kill_chain_phases:
  - Exploitation
  message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$
  mitre_attack_id:
  - T1586
  - T1586.003
  - T1110
  - T1110.001
  nist:
  - DE.CM
  observable:
  - name: src_ip
    type: IP Address
    role:
    - Attacker
  - name: user_arn
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time 
  - eventName
  - eventSource
  - userIdentity.userName
  - userAgent
  - userIdentity.accountId
  - sourceIPAddress
  - awsRegion
  risk_score: 49
  security_domain: threat