mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
53 lines
2.8 KiB
JSON
53 lines
2.8 KiB
JSON
{
|
|
"category": "Cloud Security",
|
|
"channel": "ESCU",
|
|
"creation_date": "2018-03-12",
|
|
"description": "Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.",
|
|
"id": "2e8948a5-5239-406b-b56b-6c50f1269af3",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2018-03-12",
|
|
"name": "AWS User Monitoring",
|
|
"narrative": "It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.<br></br>In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. <br></br>Fortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that helps you enable governance, compliance, and risk auditing of your AWS account--to give you increased visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.<br></br>The detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf",
|
|
"https://blog.redlock.io/cryptojacking-tesla"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History"
|
|
],
|
|
"detection_searches": [
|
|
"Detect AWS API Activities From Unapproved Accounts",
|
|
"Detect Spike in AWS API Activity",
|
|
"Detect new API calls from user roles",
|
|
"Detect Spike in Security Group Activity",
|
|
"Detect API activity from users without MFA"
|
|
],
|
|
"investigative_searches": [
|
|
"Investigate AWS User Activities by user field"
|
|
],
|
|
"support_searches": [
|
|
"Create a list of approved AWS service accounts",
|
|
"Baseline of API Calls per User ARN",
|
|
"Previously seen API call per user roles in CloudTrail",
|
|
"Baseline of Security Group Activity by ARN"
|
|
]
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|