Techniques
Sample rules
AWS Credential Access GetPasswordData
- source: splunk
- technicques:
- T1110.001
- T1586.003
Description
The following analytic identifies more than 10 GetPasswordData API calls within a 5-minute window in your AWS account. It leverages AWS CloudTrail logs to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.
Detection logic
`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com
| bin _time span=5m
| rename user_name as user
| stats count min(_time) as firstTime max(_time) as lastTime dc(requestParameters.instanceId) as distinct_instance_ids by signature dest user user_agent src vendor_account vendor_region vendor_product
| where distinct_instance_ids > 10
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_credential_access_getpassworddata_filter`
ASL AWS Credential Access GetPasswordData
- source: splunk
- technicques:
- T1110.001
- T1586.003
Description
The following analytic identifiesGetPasswordData API calls in your AWS account. It leverages CloudTrail logs from Amazon Security Lake to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.
Detection logic
`amazon_security_lake` api.operation=GetPasswordData
| spath input=api.request.data
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime by actor.user.uid api.operation api.service.name http_request.user_agent src_endpoint.ip actor.user.account.uid cloud.provider cloud.region instanceId
| rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|`asl_aws_credential_access_getpassworddata_filter`