security_content/detections/cloud/aws_detect_permanent_key_creation.yml at develop · Elmo-Riyani/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
name: aws detect permanent key creation
id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
version: 1
date: '2020-07-27'
author: Rod Soto, Splunk
status: experimental
type: Hunting
description: This search provides detection of accounts creating permanent keys. Permanent
  keys are not created by default and they are only needed for programmatic calls.
  Creation of Permanent key is an important event to monitor.
data_source: []
search: '`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey
  "userIdentity.type"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent
  action status responseElements.accessKey.createDate responseElements.accessKey.status
  responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with cloudwatch logs
known_false_positives: Not all permanent key creations are malicious. If there is
  a policy of rotating keys this search can be adjusted to provide better context.
references: []
tags:
  analytic_story:
  - AWS Cross Account Activity
  asset_type: AWS Account
  confidence: 50
  impact: 50
  message: tbd
  mitre_attack_id:
  - T1078
  observable:
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - userIdentity.type
  - sourceIPAddress
  - userName userIdentity.type
  - userAgent
  - action
  - status
  - responseElements.accessKey.createDate
  - esponseElements.accessKey.status
  - responseElements.accessKey.accessKeyId
  risk_score: 25
  security_domain: threat