mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
76 lines
2.8 KiB
YAML
76 lines
2.8 KiB
YAML
name: AWS Credential Access GetPasswordData
|
|
id: 4d347c4a-306e-41db-8d10-b46baf71b3e2
|
|
version: 2
|
|
date: '2024-05-21'
|
|
author: Bhavin Patel, Splunk
|
|
status: production
|
|
type: Anomaly
|
|
description: The following analytic identifies more than 10 GetPasswordData API calls
|
|
within a 5-minute window in your AWS account. It leverages AWS CloudTrail logs to
|
|
detect this activity by counting the distinct instance IDs accessed. This behavior
|
|
is significant as it may indicate an attempt to retrieve encrypted administrator
|
|
passwords for running Windows instances, which is a critical security concern. If
|
|
confirmed malicious, attackers could gain unauthorized access to administrative
|
|
credentials, potentially leading to full control over the affected instances and
|
|
further compromise of the AWS environment.
|
|
data_source:
|
|
- AWS CloudTrail GetPasswordData
|
|
search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin
|
|
_time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId)
|
|
as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by
|
|
aws_account_id src_ip user_arn userAgent eventName _time | where distinct_instance_ids
|
|
> 10 | `aws_credential_access_getpassworddata_filter`'
|
|
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
|
|
search works with AWS CloudTrail logs. We encourage the users to adjust the values
|
|
of `distinct_instance_ids` and tweak the `span` value according to their environment.
|
|
known_false_positives: Administrator tooling or automated scripts may make these calls
|
|
but it is highly unlikely to make several calls in a short period of time.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1552/
|
|
- https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
|
|
tags:
|
|
analytic_story:
|
|
- AWS Identity and Access Management Account Takeover
|
|
asset_type: AWS Account
|
|
confidence: 70
|
|
impact: 70
|
|
message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to
|
|
instance ids $instance_ids$ from IP $src_ip$
|
|
mitre_attack_id:
|
|
- T1586
|
|
- T1586.003
|
|
- T1110
|
|
- T1110.001
|
|
observable:
|
|
- name: src_ip
|
|
type: IP Address
|
|
role:
|
|
- Attacker
|
|
- name: user_arn
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- eventName
|
|
- eventSource
|
|
- userIdentity.userName
|
|
- userAgent
|
|
- userIdentity.accountId
|
|
- sourceIPAddress
|
|
- awsRegion
|
|
risk_score: 49
|
|
security_domain: threat
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json
|
|
source: aws_cloudtrail
|
|
sourcetype: aws:cloudtrail
|
|
update_timestamp: true
|