aws account

Title	Tags
a user with concurrent sessions from different ips may also represent the legitimate use of more than one device. filter as needed and/or customize the threshold to fit your environment.	t1185 aws account splunk
a user with successful authentication events from different ips may also represent the legitimate use of more than one device. filter as needed and/or customize the threshold to fit your environment.	t1110.001 T1110.003 T1535 t1586 azure tenant aws account splunk
administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.	t1110.001 t1586.003 aws account splunk
alse positives may be present based on automated tooling or system administrators. filter as needed.	t1537 aws account splunk
an ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.	T1110.003 T1110.004 aws account splunk
aws administrators may disable mfa but it is highly unlikely for this event to occur without prior notice to the company	t1556.006 t1586.003 t1621 aws account splunk
it is possible that a user downloaded these files to use them locally and there are aws services in configured that perform these activities for a legitimate reason. filter is needed.	t1119 aws account splunk
it is possible that an aws administrator has legitimately created this task for creating backup. please check the `sourcelocationarn` and `destinationlocationarn` of this task	t1119 aws account splunk
it is possible that an aws administrator has legitimately disabled versioning on certain buckets to avoid costs.	t1490 aws account splunk
it is possible that an aws administrator or a user has legitimately created this job for some tasks.	t1119 aws account splunk
it is possible that some accounts do not have mfa enabled for the aws account however its agaisnt the best practices of securing aws.	t1078.004 t1586.003 aws account splunk
it is possible to start this detection will need to be tuned by source ip or user. in addition, change the count values to an upper threshold to restrict false positives.	t1580 aws account splunk
legitimate administrators may delete guardrails as part of normal operations, such as when replacing outdated guardrails with updated versions, cleaning up test resources, or consolidating security controls. consider implementing an allowlist for expected administrators who regularly manage guardrails configurations.	t1562.008 aws account splunk
legitimate administrators may delete knowledge bases as part of normal operations, such as when replacing outdated knowledge bases, removing test resources, or consolidating information. consider implementing an allowlist for expected administrators who regularly manage knowledge base configurations.	t1485 aws account splunk
legitimate administrators may delete model invocation logging configurations during maintenance, when updating logging policies, or when cleaning up unused resources. consider implementing an allowlist for expected administrators who regularly manage logging configurations.	t1562.008 aws account splunk
legitimate administrators may occasionally delete guardduty detectors, waf rule groups, or cloudwatch alarms during environment reconfiguration, migration, or decommissioning activities. in such cases, these events are expected and benign. these should be validated against approved change tickets or deployment pipelines to differentiate malicious activity from normal operations. please consider filtering out these noisy events using useragent, user_arn field names.	t1562.008 aws account splunk
legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. access denials may also happen when automated processes are using outdated credentials or when new bedrock features are being explored.	t1078 t1550 aws account splunk
legitimate users may encounter multiple failures during permission testing, role transitions, or when service permissions are being reconfigured. high volumes of api errors may also occur during automated processes with misconfigured iam policies or when new bedrock features are being explored through api testing.	t1580 aws account splunk
legitimate users may miss to reply the mfa challenge within the time window or deny it by mistake.	t1078.004 t1586.003 t1621 google cloud platform tenant aws account splunk
multiple failed mfa requests may also be a sign of authentication or application issues. filter as needed.	t1078.004 t1586.003 t1621 azure active directory o365 tenant aws account google cloud platform tenant splunk
newly onboarded users who are registering an mfa method for the first time will also trigger this detection.	t1556.006 azure active directory aws account splunk
no false positives have been identified at this time.	t1003 t1003.001 t1003.003 t1003.005 t1005 t1012 t1016 t1021 t1021.001 t1027 T1027.011 t1036 t1036.003 t1036.004 t1037.001 t1041 t1046 t1048 t1048.003 t1053 t1053.005 T1053.007 t1055 t1055.001 T1055.002 t1059 t1059.001 t1059.002 t1059.003 t1059.004 t1059.005 t1059.007 t1068 t1069.001 t1069.002 t1070 t1070.004 T1070.008 t1071 t1071.004 t1074 t1078 t1078.004 t1082 t1087 t1087.001 t1087.002 t1087.004 t1090.001 t1090.003 t1098 t1098.003 t1105 t1110 T1110.003 t1112 t1113 t1114.001 t1124 t1127 t1129 t1134 t1134.004 t1134.005 t1185 t1190 t1195 t1200 t1202 t1203 t1204 t1204.002 T1204.003 t1207 t1210 t1212 t1218.005 t1218.007 t1218.010 t1218.011 t1220 t1222 t1222.001 t1482 t1484 t1484.001 t1485 t1486 t1489 t1490 t1497 T1497.003 t1498 t1505 t1526 t1529 t1531 t1543 t1546 t1546.001 t1546.002 t1546.011 t1547.003 t1547.005 T1547.012 t1548 t1548.002 t1552.002 t1552.004 t1552.006 t1552.007 t1553.005 t1554 t1555.003 t1555.005 t1556 T1557.002 t1558 T1558.004 t1560 t1560.001 t1562 t1562.001 t1562.004 t1562.006 t1562.008 t1564.001 t1564.004 t1566 t1566.001 t1566.002 t1574.001 T1574.009 T1590.005 t1649 amazon elastic container registry azure tenant circleci aws account o365 tenant github aws instance kubernetes infrastructure network identity windows endpoint splunk
no known false postives for this detection. please review this alert	T1110.003 T1110.004 t1586.003 aws account splunk
this detection will require tuning to provide high fidelity detection capabilties. tune based on src addresses (corporate offices, vpn terminations) or by groups of users.	t1110 t1580 aws account splunk
users may genuinely mistype or forget the password.	t1110.001 t1586.003 aws account splunk
users may genuinely reset the rds password.	t1110 t1586.003 aws account splunk
when your development is spreaded in different time zones, applying this rule can be difficult.	T1204.003 aws account splunk
while this search has no known false positives, it is possible that an aws admin has legitimately triggered an aws audit tool activity which may trigger this event.	t1201 aws account splunk
while this search has no known false positives, it is possible that it is a legitimate admin activity. please consider filtering out these noisy events using useragent, user_arn field names.	T1485.001 t1562.008 aws account splunk
while this search has no known false positives.	t1526 aws account splunk