AWS CreateAccessKey

Name:AWS CreateAccessKey
id:2a9b80d3-6340-4345-11ad-212bf3d0d111
version:12
date:None
author:Bhavin Patel, Radka Viskova, Splunk
status:production
type:Hunting
Description:This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions. Hunting queries are designed to be run manually during threat hunting activities.
Data_source:

• -AWS CloudTrail CreateAccessKey

search:`cloudtrail`
eventName = CreateAccessKey

| where (isnull(errorCode) OR errorCode="success")
AND 'userIdentity.type'="IAMUser"
AND isnotnull('userIdentity.userName')
AND isnotnull('requestParameters.userName')
AND 'userIdentity.userName'!='requestParameters.userName'

| eval
caller_arn='userIdentity.arn',
caller_principal_id='userIdentity.principalId',
caller_user='userIdentity.userName',
dest=coalesce(dest,eventSource),
signature=coalesce(signature,eventName),
src=coalesce(src,sourceIPAddress),
target_user='requestParameters.userName',
user_agent=coalesce(user_agent,userAgent),
user_arn=coalesce(user_arn,caller_arn),
vendor_account=coalesce(vendor_account,recipientAccountId),
vendor_product=coalesce(vendor_product,"AWS"),
vendor_region=coalesce(vendor_region,awsRegion)

| stats count min(_time) as firstTime
max(_time) as lastTime
values(dest) as dest
values(eventID) as eventIDs
values(signature) as signature
values(src) as src
values(user_agent) as user_agent
values(user_arn) as user_arn
values(vendor_product) as vendor_product
values(vendor_region) as vendor_region

by vendor_account caller_user caller_principal_id target_user

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_createaccesskey_filter`

how_to_implement:You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives:While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
References:
  -https://bishopfox.com/blog/privilege-escalation-in-aws
  -https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
drilldown_searches:
  :
analytic_story:['AWS IAM Privilege Escalation']

asset_type:AWS Account

mitre_attack_id:['T1136.003']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:cloud

security_domain:network

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
  sourcetype: aws:cloudtrail
  source: aws_cloudtrail
 test_type:'unit'
manual_test:None