Splunk unknown stable spl

ASL AWS Credential Access GetPasswordData

The following analytic identifiesGetPasswordData API calls in your AWS account. It leverages CloudTrail logs from Amazon Security Lake to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.

View Source

Detection Logic

`amazon_security_lake` api.operation=GetPasswordData
| spath input=api.request.data
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
    BY actor.user.uid api.operation api.service.name
       http_request.user_agent src_endpoint.ip actor.user.account.uid
       cloud.provider cloud.region instanceId
| rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `asl_aws_credential_access_getpassworddata_filter`

False Positives

  • ⚠ Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.

Field Validations

Loading…

Comments (0)

Loading comments...