ID | Technique | Tactic |
---|---|---|
T1486 | Data Encrypted for Impact | Impact |
Detection: AWS Detect Users creating keys with encrypt policy without MFA
Description
The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. It leverages AWS CloudTrail logs to identify CreateKey
or PutKeyPolicy
events where the kms:Encrypt
action is granted to all principals. This activity is significant as it may indicate a compromised account, allowing an attacker to misuse the encryption key to target other organizations. If confirmed malicious, this could lead to unauthorized data encryption, potentially disrupting operations and compromising sensitive information across multiple entities.
Search
1`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy
2| spath input=requestParameters.policy output=key_policy_statements path=Statement{}
3| mvexpand key_policy_statements
4| spath input=key_policy_statements output=key_policy_action_1 path=Action
5| spath input=key_policy_statements output=key_policy_action_2 path=Action{}
6| eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2)
7| spath input=key_policy_statements output=key_policy_principal path=Principal.AWS
8| search key_policy_action="kms:Encrypt" AND key_policy_principal="*"
9| stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId user
10| `security_content_ctime(firstTime)`
11| `security_content_ctime(lastTime)`
12|`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
AWS CloudTrail CreateKey | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
AWS CloudTrail PutKeyPolicy | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter | search * |
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
Known False Positives
unknown
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
AWS account is potentially compromised and user $user$ is trying to compromise other accounts. | 25 | 50 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3