name: AWS Excessive Security Scanning
id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
version: 1
date: '2021-04-13'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: This search looks for AWS CloudTrail events and analyse the amount of
  eventNames which starts with Describe by a single user. This indicates that this
  user scans the configuration of your AWS cloud environment.
search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
  stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
  values(eventName) as eventName values(src) as src values(userAgent) as userAgent
  by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives.
references:
- https://github.com/aquasecurity/cloudsploit
tags:
  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Account
  cis20:
  - CIS 13
  confidence: 60
  context:
  - Source:Cloud Data
  - Scope:Inbound
  - Stage:Recon
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json
  impact: 30
  kill_chain_phases:
  - Actions on Objectives
  message: user $user$ has excessive number of api calls $dc_events$ from these IP
    addresses $src$, violating the threshold of 50,  using the following commands
    $command$.
  mitre_attack_id:
  - T1526
  nist:
  - PR.DS
  - PR.AC
  - DE.CM
  observable:
  - name: src
    type: IP Address
    role:
    - Attacker
  - name: user
    type: User
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - src
  - userAgent
  - user
  - userIdentity.arn
  risk_object: src
  risk_object_type: system
  risk_score: 18
  security_domain: network