This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or
aws_service_accounts.csv. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
- Type: Hunting
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2020-07-21
- Author: Bhavin Patel, Splunk
- ID: ada0f478-84a8-4641-a3f1-d82362d4bd55
|T1078.004||Cloud Accounts||Defense Evasion, Initial Access, Persistence, Privilege Escalation|
Kill Chain Phase
- Actions on Objectives
- CIS 16
1 2 3 4 5 6 7 8 9 10 11 12 13 `cloudtrail` errorCode=success | rename userName as identity | search NOT [ | inputlookup identity_lookup_expanded | fields identity] | search NOT [ | inputlookup aws_service_accounts | fields identity] | rename identity as user | stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_aws_api_activities_from_unapproved_accounts_filter`
The SPL above uses the following Macros:
Note that detect_aws_api_activities_from_unapproved_accounts_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
The SPL above uses the following Lookups:
How To Implement
You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also populate the
identity_lookup_expanded lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called “Create a list of approved AWS service accounts”: run it once every 30 days to create and validate a list of service accounts.
This search produces fields (
lastTime) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n1. Label: AWS Event Name, Field: eventName\
- Label: First Time, Field: firstTime\
- Label: Last Time, Field: lastTime
Detailed documentation on how to create a new field within Incident Review may be found here:
Known False Positives
It’s likely that you’ll find activity detected by users/service accounts that are not listed in the
identity_lookup_expanded or ` aws_service_accounts.csv
file. If the user is a legitimate service account, update the aws_service_accounts.csv` table with that entry.
Associated Analytic story
source | version: 2