name: AWS CreateAccessKey
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
version: 3
date: '2022-03-03'
author: Bhavin Patel, Splunk
type: Hunting
datamodel: []
description: This search looks for AWS CloudTrail events where a user A who has already
  permission to create access keys, makes an API call to create access keys for another
  user B. Attackers have been know to use this technique for Privilege Escalation
  in case new victim(user B) has more permissions than old victim(user B)
search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success 
  | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
  | search match=0
  | stats
    count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
    src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
    user_arn 
  | `security_content_ctime(firstTime)` 
  | `security_content_ctime(lastTime)` 
  |`aws_createaccesskey_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately created keys for another user.
references:
- https://bishopfox.com/blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
tags:
  analytic_story:
  - AWS IAM Privilege Escalation
  asset_type: AWS Account
  cis20:
  - CIS 13
  confidence: 90
  context:
  - Source:Cloud Data
  - Scope:External
  - Outcome:Allowed
  - Stage:Privilege Escalation
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
  impact: 70
  kill_chain_phases:
  - Actions on Objectives
  message: User $user_arn$ is attempting to create access keys for $requestParameters.userName$
    from this IP $src$
  mitre_attack_id:
  - T1136.003
  - T1136
  nist:
  - PR.DS
  - PR.AC
  - DE.CM
  observable:
  - name: src
    type: IP Address
    role:
    - Attacker
  - name: user_arn
    type: User
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - userAgent
  - errorCode
  - requestParameters.userName
  risk_score: 63
  security_domain: network