LoFP / adding users to a specified group may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. user additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• T1098

Sample rules

AWS IAM User Addition to Group

• source: elastic
• technicques:
  • T1098

Description

Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM).

Detection logic

event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:AddUserToGroup and event.outcome:success