mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
name: aws detect permanent key creation
|
|
id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
|
|
version: 1
|
|
date: '2020-07-27'
|
|
author: Rod Soto, Splunk
|
|
type: Hunting
|
|
datamodel: []
|
|
description: This search provides detection of accounts creating permanent keys. Permanent
|
|
keys are not created by default and they are only needed for programmatic calls.
|
|
Creation of Permanent key is an important event to monitor.
|
|
search: '`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey
|
|
"userIdentity.type"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent
|
|
action status responseElements.accessKey.createDate responseElements.accessKey.status
|
|
responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`'
|
|
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
|
|
search works with cloudwatch logs
|
|
known_false_positives: Not all permanent key creations are malicious. If there is
|
|
a policy of rotating keys this search can be adjusted to provide better context.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- AWS Cross Account Activity
|
|
asset_type: AWS Account
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
mitre_attack_id:
|
|
- T1078
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- eventName
|
|
- userIdentity.type
|
|
- sourceIPAddress
|
|
- userName userIdentity.type
|
|
- userAgent
|
|
- action
|
|
- status
|
|
- responseElements.accessKey.createDate
|
|
- esponseElements.accessKey.status
|
|
- responseElements.accessKey.accessKeyId
|
|
security_domain: threat
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context: []
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
message: tbd
|