Name:AWS New MFA Method Registered For User id:4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b version:12 date:None author:Bhavin Patel, Splunk status:production type:TTP Description:The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the `CreateVirtualMFADevice` event. This activity is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to secure their access, making it difficult to detect and remove their presence, potentially leading to further unauthorized activities and data breaches. Data_source:
| stats count min(_time) as firstTime max(_time) as lastTime BY signature dest user user_agent src vendor_account vendor_region vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_new_mfa_method_registered_for_user_filter`
how_to_implement:You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs. known_false_positives:Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. References: -https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ -https://attack.mitre.org/techniques/T1556/ -https://attack.mitre.org/techniques/T1556/006/ -https://twitter.com/jhencinski/status/1618660062352007174 drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['AWS Identity and Access Management Account Takeover']
