mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mvelazco
64 lines
2.4 KiB
YAML
64 lines
2.4 KiB
YAML
name: AWS Credential Access GetPasswordData
|
|
id: 4d347c4a-306e-41db-8d10-b46baf71b3e2
|
|
version: 1
|
|
date: '2022-08-10'
|
|
author: Bhavin Patel, Splunk
|
|
type: Anomaly
|
|
datamodel: []
|
|
description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance.
|
|
search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time
|
|
| where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`'
|
|
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment.
|
|
known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1552/
|
|
- https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
|
|
tags:
|
|
analytic_story:
|
|
- AWS Identity and Access Management Account Takeover
|
|
asset_type: AWS Account
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 70
|
|
context:
|
|
- Source:Cloud Data
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events.json
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$
|
|
mitre_attack_id:
|
|
- T1586
|
|
- T1586.003
|
|
- T1110
|
|
- T1110.001
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: src_ip
|
|
type: IP Address
|
|
role:
|
|
- Attacker
|
|
- name: user_arn
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- eventName
|
|
- eventSource
|
|
- userIdentity.userName
|
|
- userAgent
|
|
- userIdentity.accountId
|
|
- sourceIPAddress
|
|
- awsRegion
|
|
risk_score: 49
|
|
security_domain: threat
|