ID | Technique | Tactic |
---|---|---|
T1586 | Compromise Accounts | Resource Development |
T1586.003 | Cloud Accounts | Resource Development |
T1078 | Valid Accounts | Defense Evasion |
T1078.004 | Cloud Accounts | Initial Access |
Detection: AWS Successful Single-Factor Authentication
Description
The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. It leverages AWS CloudTrail logs to detect instances where MFA was not used during login. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to the AWS environment, potentially leading to data exfiltration, resource manipulation, or further privilege escalation.
Search
1`cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No
2| stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode additionalEventData.MFAUsed userAgent eventID awsRegion user_name userIdentity.arn
3| `security_content_ctime(firstTime)`
4| `security_content_ctime(lastTime)`
5| `aws_successful_single_factor_authentication_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
AWS CloudTrail ConsoleLogin | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
N/A |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
aws_successful_single_factor_authentication_filter | search * |
aws_successful_single_factor_authentication_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
Known False Positives
It is possible that some accounts do not have MFA enabled for the AWS account however its agaisnt the best practices of securing AWS.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$ | 64 | 80 | 80 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2